A SOC analyst receives a ticket for a single workstation that is exhibiting unusual network behavior. The workstation is a standard user machine with no elevated privileges, and the behavior appears isolated. The analyst has verified that the activity is not a false positive. According to standard incident management procedures, what should the analyst do first?

Escalate the ticket to L2 immediately because any confirmed malicious activity must be escalated without delay.

Close the ticket as resolved because the analyst has already verified the activity is not a false positive.

Update the ticket with the investigation findings, assign a priority based on impact and urgency, and proceed with containment actions.

Assign the ticket a low priority and continue monitoring, since the impact is limited to one workstation.

A SOC analyst is triaging multiple incidents. Incident A is a confirmed malware infection on a single non-critical server. Incident B is a suspected phishing email that has been reported by one user, but the email has not been opened. Incident C is a DDoS attack against the company's public website, which is currently under attack. The analyst has limited resources and can only work on one incident at a time. Which incident should the analyst prioritize first?

Incident A, because it is confirmed and requires immediate containment.

Incident B, because phishing can lead to credential compromise.

Incident C, because it is actively impacting a public-facing service and has high urgency.

All incidents should be handled simultaneously because they are all important.

Which statement correctly describes the role of Level 3 (L3) responders in an incident escalation hierarchy?

L3 responders provide advanced expertise, such as malware reverse engineering and threat hunting

L3 responders focus on restoring user access and resetting passwords

L3 responders are responsible for communicating incident status to executive leadership

L3 responders are the first to receive alerts and perform initial classification

A SOC analyst is documenting a phishing incident in the ticketing system. The analyst has identified the malicious email, the affected user, and the actions taken to quarantine the email. What additional information is most important to include in the ticket to support later analysis and auditing?

The exact timestamp of when the analyst first saw the alert and when each action was taken.

The ticket number of a similar incident from last month.

The user's job title and department.

The name of the SOC manager who will review the ticket.

Why is it important to record accurate timestamps in an incident ticket?

To satisfy the preference of the incident commander

To allow analysts to log in and out of the system

To make the ticket appear more professional

To provide a chronological record for analysis, auditing, and legal proceedings

EC-CouncilSOC Essentials

Domain 6Objective 5

Incident Escalation and Ticketing Systems SCE Practice Questions (Page 2)

Part of the Incident Detection and Analysis domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 6–10

6application · medium
A SOC analyst receives a ticket for a single workstation that is exhibiting unusual network behavior. The workstation is a standard user machine with no elevated privileges, and the behavior appears isolated. The analyst has verified that the activity is not a false positive. According to standard incident management procedures, what should the analyst do first?
Select an answer first
7expert · hard
A SOC analyst is triaging multiple incidents. Incident A is a confirmed malware infection on a single non-critical server. Incident B is a suspected phishing email that has been reported by one user, but the email has not been opened. Incident C is a DDoS attack against the company's public website, which is currently under attack. The analyst has limited resources and can only work on one incident at a time. Which incident should the analyst prioritize first?
Select an answer first
8foundation · easy
Which statement correctly describes the role of Level 3 (L3) responders in an incident escalation hierarchy?
Select an answer first
9application · medium
A SOC analyst is documenting a phishing incident in the ticketing system. The analyst has identified the malicious email, the affected user, and the actions taken to quarantine the email. What additional information is most important to include in the ticket to support later analysis and auditing?
Select an answer first
10foundation · easy
Why is it important to record accurate timestamps in an incident ticket?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Incident Escalation and Ticketing Systems SCE Practice Questions (Page 2)

Questions 6–10

Which statement correctly describes the role of Level 3 (L3) responders in an incident escalation hierarchy?

A SOC analyst is documenting a phishing incident in the ticketing system. The analyst has identified the malicious email, the affected user, and the actions taken to quarantine the email. What additional information is most important to include in the ticket to support later analysis and auditing?

Why is it important to record accurate timestamps in an incident ticket?

Keep studying — Incident Detection and Analysis