1.4 Explain the Function of Incident Categorization and Prioritization CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC analyst is triaging a new alert. The alert shows a workstation communicating with a known command-and-control domain. The workstation belongs to the finance department and handles sensitive payroll data. The analyst must categorize this incident. Which combination of criteria is most appropriate for categorization?

   • ATime of detection, analyst name, and ticket number.
   • BAttack vector (C2 communication), affected asset (finance workstation), and impact type (potential data exfiltration).
   • CUrgency score, severity level, and business criticality rating.
   • DNumber of users affected, cost of remediation, and legal notification requirements.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How does incident categorization inform prioritization?

   • ACategorization replaces the need for prioritization
   • BCategorization provides context about the incident type, which helps assess its potential impact and urgency
   • CCategorization determines the exact response time for each incident
   • DCategorization assigns a severity score automatically
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why do categorization and prioritization work together in effective incident response?

   • ACategorization organizes incidents, and prioritization directs resources to the most important ones
   • BPrioritization eliminates the need for categorization
   • CPrioritization determines the category of an incident
   • DCategorization ensures all incidents are treated equally
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC team is evaluating two prioritization frameworks. Framework 1 uses a 2x2 matrix with impact and urgency. Framework 2 uses a scoring system with 10 criteria, including impact, urgency, asset criticality, and threat intelligence. The team needs a framework that is quick to apply but also captures the nuance of different incident types. Which approach best balances speed and nuance?

   • AUse Framework 1 for low-priority incidents and Framework 2 for all others.
   • BUse Framework 1 as the primary triage tool and apply Framework 2 for complex or high-priority incidents.
   • CUse only Framework 1 because it is faster and easier for all analysts.
   • DUse only Framework 2 because it captures more detail and is therefore more accurate.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC receives an alert about a brute-force attack on a VPN gateway. The analyst needs to categorize the incident to route it to the correct response team. Which categorization is most appropriate?

   • AAttack vector: DDoS; Affected asset: Web server; Impact type: Denial of service.
   • BAttack vector: Malware; Affected asset: Endpoint; Impact type: Data loss.
   • CAttack vector: Brute-force; Affected asset: VPN gateway; Impact type: Unauthorized access.
   • DAttack vector: Phishing; Affected asset: Email server; Impact type: Credential theft.
   Reveal Solution Discussion Select an answer first