1.4 Explain the Function of Incident Categorization and Prioritization CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC analyst categorizes an incident as 'Insider Threat' involving a finance manager who accessed a competitor's data. The analyst then prioritizes it as 'High' because the manager has access to sensitive financial information. Which statement best describes how categorization and prioritization work together here?

   • AThe analyst should have skipped categorization and prioritized based on the manager's job title alone.
   • BCategorization is only useful for reporting, while prioritization is the only factor that matters for response.
   • CThe category 'Insider Threat' and the asset 'finance manager' provide the context that justifies the 'High' priority.
   • DThe 'High' priority determines that the incident should be re-categorized as 'Data Exfiltration'.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of incident categorization in a SOC?

   • ATo determine the financial cost of an incident
   • BTo group incidents by their type and characteristics for consistent handling
   • CTo automatically resolve incidents without human intervention
   • DTo assign a severity score based on business impact
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an example of an incident categorization criterion?

   • AThe severity level assigned by the analyst
   • BThe business criticality of the asset
   • CThe urgency of the response
   • DThe affected asset
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC uses a prioritization framework that assigns points for impact and urgency. An incident involving a compromised domain admin account has an impact score of 5 (critical) and an urgency score of 4 (high). Another incident involving a compromised standard user account has an impact score of 2 (low) and an urgency score of 5 (critical). Which incident should be handled first according to the framework?

   • AThe domain admin incident, because its higher impact score outweighs the slightly lower urgency score.
   • BThe standard user incident, because it is more urgent and therefore more critical.
   • CBoth incidents equally, because the total scores are equal (9 vs 7).
   • DThe standard user incident, because its urgency score is higher.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the main purpose of incident prioritization in a SOC?

   • ATo identify the responsible analyst for each incident
   • BTo determine the order and urgency of response
   • CTo document the incident timeline for legal purposes
   • DTo categorize incidents by attack vector
   Reveal Solution Discussion Select an answer first