Incident Escalation and Ticketing Systems SCE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A SOC analyst has been investigating a suspicious PowerShell command on a server. The analyst has determined it is likely malicious and has isolated the server. The analyst needs to escalate to L2, but the L2 team is currently handling another critical incident. The analyst's shift is ending in 30 minutes. What is the best course of action?

   • AClose the ticket because the server is isolated and the immediate threat is contained.
   • BEscalate to L3 directly because L2 is busy.
   • CEscalate the ticket to L2 with a detailed summary and coordinate a handoff with the oncoming shift.
   • DWait until the next shift to escalate to avoid interrupting L2.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SOC analyst is monitoring a SIEM dashboard and sees a spike in failed login attempts against a domain controller. The source IP is internal and the account names are generic service accounts. The analyst has not yet confirmed whether any login succeeded. What should the analyst do?

   • ACreate a ticket, assign a medium priority, and continue investigating to determine if any login succeeded.
   • BBlock the internal source IP immediately to prevent further attempts.
   • CIgnore the alert because failed logins are often benign and do not require action.
   • DEscalate to L2 immediately because the target is a domain controller and the attack may be critical.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   An L1 analyst has been working on a ticket for a malware infection. The analyst has removed the malware and verified the system is clean. The analyst marks the ticket as 'Resolved'. Later, the user reports that the system is still behaving strangely. What is the most appropriate action?

   • AReopen the ticket and continue investigating the new symptoms.
   • BIgnore the user's report because the malware was removed.
   • CCreate a new ticket for the new symptoms and close the old one.
   • DEscalate to L3 immediately without reopening the ticket.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A SOC analyst has identified a critical vulnerability being exploited in the wild that affects the company's internet-facing servers. The analyst has confirmed the exploitation on one server. The escalation procedure states that the incident commander should be notified within 15 minutes of confirmation. The analyst has already spent 10 minutes documenting the findings in the ticket. What should the analyst do now?

   • AFinish documenting all details in the ticket before notifying the incident commander, to ensure a complete handoff.
   • BEscalate directly to L3 without notifying the incident commander, because L3 can handle the technical response.
   • CNotify the incident commander immediately via the designated urgent channel, then complete the ticket documentation.
   • DWait for the 15-minute mark to pass to see if the incident resolves itself.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A SOC analyst is triaging multiple tickets. Ticket A is a suspected phishing email that was delivered to 5 users, but no one has clicked. Ticket B is a confirmed malware infection on a single non-critical workstation. Ticket C is a potential data breach of a database containing customer PII, but the breach is not confirmed. The analyst has limited resources. Which ticket should be prioritized first?

   • ATicket C because of the potential PII exposure and high impact.
   • BAll tickets equally because each requires attention.
   • CTicket A because phishing can spread quickly.
   • DTicket B because malware is confirmed and active.
   Reveal Solution Discussion Select an answer first