Incident Escalation and Ticketing Systems SCE Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   An L2 analyst has just taken over a ticket from L1. The ticket contains the initial alert details and a note that 'further investigation is needed.' What is the most important action for the L2 analyst to take first?

   • AContact the L1 analyst by phone to ask for a verbal summary.
   • BStart a new investigation from scratch to avoid bias from the L1 analyst's notes.
   • CReopen the ticket and change the priority to high to ensure it gets attention.
   • DReview the ticket history and any attached evidence to understand what has been done so far.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   When an incident is escalated from L1 to L2, what should the L1 analyst do in the ticketing system to ensure a seamless handoff?

   • ALeave the ticket unchanged and send an email to L2
   • BDelete the ticket and inform L2 verbally
   • CUpdate the ticket with a summary of findings and reassign it to the L2 queue
   • DClose the ticket and create a new one for L2
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   A SOC analyst receives a ticket about a malware infection on a single non-critical workstation. The infection is contained and does not affect business operations. What priority should be assigned to this ticket?

   • AHigh
   • BMedium
   • CLow
   • DCritical
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What type of information should be documented in a ticket to support effective incident analysis?

   • APersonal opinions about the incident's cause
   • BThe estimated cost of the incident, even if not yet confirmed
   • CThe complete chain of events, including indicators of compromise, actions taken, and timestamps
   • DOnly the final resolution and the name of the analyst who closed the ticket
   Reveal Solution Discussion Select an answer first