Incident Escalation and Ticketing Systems SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC analyst receives a ticket for a potential data breach involving a database with customer PII. The breach is suspected but not confirmed. The database is not publicly accessible, and there is no evidence of data exfiltration yet. What priority should the analyst assign to this ticket?

   • ALow, because the database is not publicly accessible and there is no confirmed exfiltration.
   • BMedium, because the incident is unconfirmed but involves sensitive data and requires investigation.
   • CHigh, because any potential data breach must be treated as critical until proven otherwise.
   • DCritical, because customer PII is involved and the incident must be escalated immediately.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a major incident, the SOC manager instructs the L1 analyst to escalate the incident to L3 and notify the CISO. The analyst has already created a ticket and documented the initial findings. What should the analyst do next?

   • AWait for the L3 team to acknowledge the ticket before notifying the CISO.
   • BClose the ticket and create a new one for the L3 team to avoid confusion.
   • CUse the designated urgent communication channel to notify L3 and the CISO, and update the ticket with the escalation details.
   • DSend an email to the L3 team and the CISO with the ticket number and a summary.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which communication channel is most appropriate for escalating a critical, time-sensitive incident to on-call SOC management?

   • AA post on the internal social media forum
   • BA detailed email sent to the entire department
   • CA comment in the ticket without any direct notification
   • DA phone call or SMS to the on-call manager, followed by a documented update in the ticketing system
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC analyst is using the ticketing system to manage a phishing incident. The analyst has created a ticket, assigned it to themselves, and is now investigating the email. Which action best illustrates the tracking function of the ticketing system?

   • AUpdating the ticket status to 'In Progress' and adding a note about the email headers.
   • BDeleting the ticket after the user reports the email.
   • CMarking the ticket as resolved immediately after creating it.
   • DSending the email headers to the user for their records.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst discovers that a critical internal application server is sending outbound traffic to an unknown IP address. The analyst has verified that the server is not supposed to communicate externally. The analyst has already created a ticket and is about to escalate. What is the most appropriate communication step?

   • AUpdate the ticket and wait for the next shift to review it.
   • BNotify the L2 team via the ticketing system and also call the on-call incident responder to ensure immediate attention.
   • CSend an email to the entire SOC team and wait for someone to respond.
   • DContact the server's business owner first to ask if the traffic is expected.
   Reveal Solution Discussion Select an answer first