Incident Escalation and Ticketing Systems SCE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An L1 analyst has been working on a ticket for several hours and has performed multiple actions, including blocking an IP, quarantining a file, and resetting a user's password. The analyst is about to escalate the ticket to L2. What is the most important documentation practice to ensure a smooth handoff?

   • AInclude a summary of all actions taken, with timestamps, and the current status of the incident.
   • BWait until the L2 analyst asks for more information before adding details.
   • CInclude the names of all users affected, even if they are not directly related to the incident.
   • DOnly include the final result of the investigation, because the L2 analyst can see the ticket history.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC analyst is working on a ticket that has been moved to the 'In Progress' state. The analyst has completed the investigation and applied a temporary workaround. The incident is not fully resolved, but the immediate risk has been mitigated. What should the analyst do next?

   • AKeep the ticket in 'In Progress' and document the workaround and next steps in the ticket.
   • BEscalate the ticket to L3 because a workaround was needed.
   • CMove the ticket to 'Resolved' because the immediate risk has been mitigated.
   • DMove the ticket to 'Closed' and reopen it later if the issue recurs.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC team has detected a malware outbreak affecting multiple servers. The L1 analyst has confirmed the indicators and is preparing to escalate. According to the escalation hierarchy, who should be notified first?

   • AThe system administrator of the affected servers, because they can reboot the servers.
   • BThe Chief Information Security Officer (CISO), because the incident affects multiple servers.
   • CThe legal department, because malware outbreaks may have legal implications.
   • DThe L2 team, because they handle deeper analysis and containment of confirmed incidents.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC analyst at a large enterprise detects a widespread ransomware outbreak affecting multiple servers and workstations. The analyst has confirmed the ransomware is actively encrypting files. According to typical escalation levels, what is the most appropriate initial escalation?

   • AEscalate to L2 and wait for their analysis before notifying management.
   • BEscalate to L3 and notify the incident commander and executive management immediately.
   • CEscalate to L2 but do not notify management until the extent is known.
   • DHandle at L1 by isolating affected hosts and continue monitoring.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC analyst is investigating an alert about a user account that has been locked out multiple times. The analyst finds that the user is traveling and has been entering the wrong password. The analyst has confirmed there is no malicious activity. What should the analyst do?

   • ABlock the user's account to prevent further lockouts.
   • BCreate a ticket, document the finding as a false positive, and close the ticket.
   • CAssign a high priority to the ticket because account lockouts can disrupt business operations.
   • DEscalate the incident to L2 because account lockouts are always a sign of a brute-force attack.
   Reveal Solution Discussion Select an answer first