Incident Escalation and Ticketing Systems SCE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When escalating an incident to a higher tier, which step is most important to perform first?

   • AGather and document all relevant incident details, including actions taken and evidence
   • BWait for the user to provide additional information before escalating
   • CDelete any potentially malicious files to prevent further infection
   • DNotify the incident commander and schedule a meeting for the next day
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An L1 analyst is documenting a ticket for a suspicious login on a user's account. The analyst has verified the login was from a foreign country and the user was not traveling. The analyst has reset the password and is now updating the ticket. Which piece of information is most critical to include for future auditing?

   • AThe analyst's name and shift number.
   • BThe IP address and timestamp of the suspicious login.
   • CThe user's phone number for contact.
   • DThe user's job title and department.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC analyst discovers a potential ransomware infection on a file server containing sensitive customer data. The analyst has confirmed the presence of encryption activity. According to the escalation procedure, which action should the analyst take first?

   • AIsolate the file server from the network before notifying anyone, to prevent further spread.
   • BContact the incident commander via phone and then create a ticket with all known details.
   • CWait for the ticket to be automatically escalated by the system after a predefined time threshold.
   • DCreate a high-priority ticket and immediately notify the L2/L3 team through the designated urgent communication channel.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Why is it important to log escalation actions within the ticketing system?

   • ATo provide a complete audit trail of the incident response process
   • BTo increase the number of tickets in the system
   • CTo allow analysts to bypass communication with other teams
   • DTo automatically resolve the incident without further action
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of a ticketing system in incident management?

   • ATo replace the need for direct communication between SOC team members
   • BTo store only final reports after an incident is closed
   • CTo provide a centralized, auditable record for tracking incidents from creation to resolution
   • DTo automate all security responses without human intervention
   Reveal Solution Discussion Select an answer first