1.4 Explain the Function of Incident Categorization and Prioritization CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a common prioritization framework used in SOC operations?

   • AA list of incident categories sorted alphabetically
   • BA matrix based on impact and urgency
   • CA framework based solely on the number of affected users
   • DA random selection process
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC team wants to standardize how incidents are prioritized. They currently rely on individual analyst judgment, which leads to inconsistent response times. They need a framework that considers both the potential damage of an incident and how quickly it must be addressed. Which approach best meets this requirement?

   • AUse the category of the incident as the sole determinant of priority.
   • BAssign priority based solely on the number of alerts received in the past hour.
   • CLet each analyst continue using their own judgment but document the decision afterward.
   • DAdopt an impact-urgency matrix that maps incidents to priority levels based on these two dimensions.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC team has a queue of incidents. One incident involves a ransomware infection on a single file server that is not yet encrypted. Another involves a phishing email that was opened by an executive but no credentials were entered. A third involves a vulnerability scan finding on a non-internet-facing development server. The team lead must decide which to handle first. Which approach best reflects the purpose of incident prioritization?

   • AHandle the ransomware incident first because it has the highest potential impact and urgency, even though it is not yet fully realized.
   • BHandle all three simultaneously by assigning one analyst to each incident.
   • CHandle the phishing incident first because it involves an executive, regardless of the lack of credential compromise.
   • DHandle the vulnerability scan finding first because it was detected by an automated tool and is therefore more reliable.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following best describes an impact-urgency prioritization matrix?

   • AIt sorts incidents by the time they were reported
   • BIt assigns priority based on the combination of impact and urgency
   • CIt ranks incidents by the cost of remediation
   • DIt categorizes incidents by attack vector
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC uses a prioritization matrix with impact on one axis and urgency on the other. An incident involves a compromised service account that has access to a non-critical application. The account is not actively being used by the attacker, but it could be used to access the application. The application is scheduled for decommissioning in two weeks. How should this incident be prioritized?

   • ADefer the incident until the application is decommissioned.
   • BHigh priority because any compromised account is a critical security event.
   • CLow priority because the impact is low (non-critical application) and the urgency is low (no active use).
   • DMedium priority because the account is compromised, which increases urgency.
   Reveal Solution Discussion Select an answer first