Which combination of factors is most commonly used to determine the priority of a security incident ticket?

Number of open tickets and system uptime

Ticket number and reporter's name

Time of day and analyst availability

In a typical ticket lifecycle, what does the 'resolved' state indicate?

The underlying issue has been addressed and the ticket is awaiting verification or closure

The ticket has been assigned to a higher tier for further analysis

The ticket has been created and is waiting for an analyst to be assigned

The incident has been fully investigated and the ticket is permanently closed

In a typical SOC escalation hierarchy, which responsibility is most closely associated with Level 2 (L2) analysts?

Developing new detection rules and performing threat hunting

Performing initial triage and validating whether an alert is a true positive

Making final decisions on incident closure and post-incident reviews

Conducting in-depth analysis, containment, and eradication of complex threats

A SOC analyst is triaging a ticket for a possible denial-of-service (DoS) attack on the company's public website. The website is currently slow but still accessible. The attack is ongoing. What priority should the analyst assign to this ticket?

Medium priority because the website is still accessible.

High priority because the attack is ongoing and affects a public-facing service.

Critical priority because any DoS attack is always critical.

Low priority because the website is only slow.

A SOC analyst is monitoring a low-severity malware alert on a single non-critical workstation. The analyst has confirmed the malware is a known adware and has removed it. The workstation is used by a temporary contractor. Which of the following best describes the appropriate escalation decision?

Escalate to L2 because any malware requires deeper analysis.

Do not escalate; document the removal and close the ticket after verification.

Escalate to L3 because the contractor's machine may have sensitive data.

Escalate to management because the contractor may be a risk.

EC-CouncilSOC Essentials

Domain 6Objective 5

Incident Escalation and Ticketing Systems SCE Practice Questions (Page 4)

Part of the Incident Detection and Analysis domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 16–20

16foundation · easy
Which combination of factors is most commonly used to determine the priority of a security incident ticket?
Select an answer first
17foundation · easy
In a typical ticket lifecycle, what does the 'resolved' state indicate?
Select an answer first
18foundation · easy
In a typical SOC escalation hierarchy, which responsibility is most closely associated with Level 2 (L2) analysts?
Select an answer first
19application · medium
A SOC analyst is triaging a ticket for a possible denial-of-service (DoS) attack on the company's public website. The website is currently slow but still accessible. The attack is ongoing. What priority should the analyst assign to this ticket?
Select an answer first
20application · medium
A SOC analyst is monitoring a low-severity malware alert on a single non-critical workstation. The analyst has confirmed the malware is a known adware and has removed it. The workstation is used by a temporary contractor. Which of the following best describes the appropriate escalation decision?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.