Incident Escalation and Ticketing Systems SCE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a core function of a ticketing system in incident management?

   • AAssigning tickets to appropriate analysts and tracking their status
   • BBlocking malicious IP addresses at the firewall
   • CPerforming forensic analysis of disk images
   • DAutomatically patching vulnerable systems
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC analyst receives a ticket for a potential data breach involving a database containing customer PII. The breach is suspected but not confirmed. The database is used by the sales team and is critical to daily operations. What priority should the analyst assign to this ticket?

   • ACritical priority because any PII breach is always critical.
   • BLow priority because the ticket is just a suspicion.
   • CMedium priority because the breach is only suspected, not confirmed.
   • DHigh priority because of the potential PII exposure and criticality of the system.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC analyst is handling a suspected insider threat. An employee is downloading large amounts of data from a file server to a USB drive. The analyst has confirmed the activity is ongoing and has alerted the L2 team through the ticketing system. What is the most appropriate next communication step?

   • ASend a detailed email to the employee's manager and wait for a reply.
   • BWait for L2 to acknowledge the ticket before taking any further action.
   • CCall the on-call incident responder to ensure immediate awareness and coordinate a response.
   • DPost a message in the SOC team's chat channel and hope someone sees it.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An L1 analyst has been investigating a suspicious login from an unusual location for a user. The analyst has verified that the login was not authorized and has reset the user's password. The analyst now needs to escalate the incident to L2 for further investigation. What is the most appropriate way to document the escalation in the ticketing system?

   • AReassign the ticket to the L2 queue and add a note summarizing the investigation and actions taken.
   • BChange the ticket category to 'escalated' and leave it unassigned.
   • CClose the ticket and create a new one for L2 to avoid clutter.
   • DEmail L2 the details and leave the ticket in the L1 queue.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An L1 analyst has been working on a ticket for a suspected ransomware infection on a single workstation. The analyst has isolated the host and collected the memory dump. The analyst is now waiting for L2 to perform deeper analysis. What is the correct ticket state at this point?

   • AIn Progress, assigned to L2 for continued investigation.
   • BResolved, because the host is isolated and the immediate threat is contained.
   • COpen, but unassigned until L2 picks it up.
   • DClosed, because the analyst has completed all L1 actions.
   Reveal Solution Discussion Select an answer first