1.4 Explain the Function of Incident Categorization and Prioritization CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC receives an alert that a user clicked a link in a phishing email. The link downloaded a file that was blocked by endpoint protection. The user's machine shows no signs of compromise. The analyst must categorize this incident. The SOC has separate playbooks for 'Phishing', 'Malware', and 'User Awareness'. Which categorization is most appropriate to ensure the correct response?

   • ACategorize as 'Phishing' because the initial vector was a phishing email, and note the blocked malware as a secondary characteristic.
   • BCreate a new category 'Phishing-Malware' because the incident spans two categories.
   • CCategorize as 'Malware' because a file was downloaded, even though it was blocked.
   • DCategorize as 'User Awareness' because the user clicked a link, indicating a training need.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC analyst receives three alerts simultaneously: a phishing email reported by a user, a failed login attempt from a known internal IP, and a malware signature match on a domain controller. The analyst needs to organize these into a structured workflow for the team. Which action best demonstrates the purpose of incident categorization?

   • AAssign each alert to a category such as 'Phishing', 'Authentication', and 'Malware' based on the attack vector and affected asset.
   • BRank the alerts by the potential financial loss to the company to decide which to investigate first.
   • CCreate a single ticket labeled 'Security Alerts' and assign it to the first available analyst.
   • DImmediately escalate all three alerts to the incident response lead for manual review.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC team wants to implement a prioritization framework that is easy to understand and can be applied quickly by all analysts. They need a framework that categorizes incidents into four priority levels based on the combination of impact and urgency. Which framework best fits this requirement?

   • AA 2x2 matrix with 'Impact' and 'Urgency' axes, producing four quadrants from low to critical priority.
   • BA framework based solely on the number of affected users.
   • CA framework that assigns priority based on the analyst's personal experience.
   • DA complex scoring system with 20 different criteria and weighted formulas.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a SOC, what does incident prioritization primarily influence?

   • AThe choice of security tools used for monitoring
   • BThe classification of incidents into categories
   • CThe sequence in which incidents are investigated and resolved
   • DThe retention period for incident logs
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC analyst is categorizing an incident where an attacker exploited a vulnerability in a web application to gain access to a backend database. The database contains customer PII. The analyst must choose a single primary category. Which categorization is most appropriate for routing to the correct response team?

   • AAttack vector: Malware; Affected asset: Endpoint; Impact type: Ransomware.
   • BAttack vector: SQL injection; Affected asset: Web server; Impact type: Defacement.
   • CAttack vector: Phishing; Affected asset: User account; Impact type: Credential theft.
   • DAttack vector: Web application exploitation; Affected asset: Backend database; Impact type: Data breach.
   Reveal Solution Discussion Select an answer first