Incident Escalation and Ticketing Systems SCE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which sequence correctly represents the typical ticket lifecycle states in an incident management system?

   • AAssigned → Open → Closed → Resolved → In-Progress
   • BOpen → Assigned → In-Progress → Resolved → Closed
   • CIn-Progress → Open → Assigned → Closed → Resolved
   • DClosed → Resolved → In-Progress → Assigned → Open
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A SOC analyst is responding to a critical incident involving a compromised domain controller. The analyst has isolated the domain controller and is about to escalate. The incident response plan specifies that the CISO must be notified within 15 minutes of confirmation. The analyst has already spent 10 minutes investigating. What is the most appropriate action?

   • ANotify the CISO immediately via phone and then update the ticketing system.
   • BUpdate the ticketing system first and then notify the CISO.
   • CNotify the CISO via email to have a written record.
   • DWait until the investigation is complete before notifying the CISO.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A SOC has a three-tier escalation structure. An L1 analyst receives a ticket about a potential ransomware infection on a user's workstation. The analyst has confirmed the presence of ransomware and has isolated the workstation. The incident is contained but not eradicated. According to the escalation hierarchy, what should the analyst do?

   • AClose the ticket because the workstation is isolated and the threat is contained.
   • BNotify the user that the issue is resolved and they can reconnect the workstation.
   • CEscalate directly to L3 because ransomware is a critical incident.
   • DEscalate to L2 for further investigation and eradication, and update the ticket with the containment actions.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following situations is the clearest trigger for escalating an incident to higher-level responders or management?

   • AA critical server is infected with ransomware and the encryption is spreading to other systems
   • BA scheduled maintenance window is about to begin for a non-critical application
   • CA user reports a phishing email that was quarantined by the email gateway and no user clicked the link
   • DA low-priority ticket about a forgotten password is waiting for user confirmation
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An L2 analyst has completed the investigation of a malware incident and has confirmed that the malware was removed and the system is clean. The analyst has updated the ticket with the findings. What is the appropriate next step in the ticket lifecycle?

   • AMark the ticket as 'Resolved' and then have the L1 analyst verify and close it.
   • BReopen the ticket to ensure the user is satisfied.
   • CClose the ticket immediately after marking it resolved.
   • DLeave the ticket in 'In Progress' until the next shift.
   Reveal Solution Discussion Select an answer first