5.3 Implementing the Case Management Lifecycle PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC team is creating a standard template for case handoff documentation. The template should ensure that the next analyst can quickly understand the case and continue the investigation without needing to ask clarifying questions. Which of the following elements should be included in the template?

   • AThe names of all team members who have ever worked on the case
   • BThe list of all tools used by the SOC in general
   • CThe personal opinions of the previous analyst about the case
   • DThe case ID, current stage, and a summary of actions taken
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC analyst is handing off a case to a colleague in a different time zone. The analyst has prepared a handoff document that includes the case summary, actions taken, and next steps. However, the analyst has not included the contact information for the system owner. What is the most likely consequence of this omission?

   • AThe colleague will need to redo the entire investigation
   • BThe case will be closed due to incomplete documentation
   • CThe case will be automatically escalated to the next tier
   • DThe colleague will have difficulty reaching the system owner for approvals or information
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security operations center (SOC) receives a case that has been confirmed as a false positive after initial triage. According to standard case management criteria, which response stage should this case be assigned to?

   • AEscalation
   • BRemediation
   • CClosure
   • DInvestigation
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC manager is reviewing the case queue to ensure cases are routed to the correct stage. A case involves a confirmed malware infection on a single workstation, and the analyst has already isolated the workstation from the network. The malware has been identified, but the analyst has not yet removed it from the system. Which stage should this case be assigned to?

   • AContainment
   • BEradication
   • CRecovery
   • DTriage
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC is reviewing its case assignment criteria. Currently, any case involving a malware infection is assigned to the containment stage immediately, even if the infection is not confirmed. This has led to cases being escalated unnecessarily because the containment stage has a strict SLA. What change to the assignment criteria would best reduce unnecessary escalations?

   • ARemove the SLA for the containment stage
   • BAssign cases to triage until the malware infection is confirmed
   • CAssign all malware cases to the eradication stage directly
   • DEscalate all malware cases to the threat hunting team immediately
   Reveal Solution Discussion Select an answer first