1.4 Explain the Function of Incident Categorization and Prioritization CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   Which of the following is a common criterion used to categorize incidents?

   • AThe number of analysts available
   • BThe cost of the security tools in use
   • CThe time of day the incident occurred
   • DThe attack vector used
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SOC has two incidents. Incident A is a ransomware infection on a file server that is actively encrypting files. Incident B is a data exfiltration of a customer database that occurred over the past week and was only just detected. The SOC has a single incident response team. Which incident should be prioritized and why?

   • AIncident B, because it was detected first and should be handled in order of detection.
   • BIncident A, because it is actively occurring and requires immediate action to stop the spread and limit damage.
   • CIncident B, because data exfiltration of customer data has a higher long-term impact.
   • DIncident A, because ransomware always has a higher impact than data exfiltration.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC has two incidents: one is a ransomware infection on a file server that is actively encrypting files, and the other is a low-severity port scan on a public-facing web server. The team has limited staff and can only work one incident at a time. Which incident should be prioritized and why?

   • ABoth incidents equally, because all incidents require the same level of attention.
   • BThe ransomware incident, because it has higher urgency and impact due to active encryption of critical files.
   • CThe port scan, because it was detected first and should be handled in order of arrival.
   • DThe port scan, because it targets a public-facing system and is therefore more critical.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SOC analyst categorizes an incident as 'Data Exfiltration' involving a customer database. The analyst then assigns it a priority of 'High' because the database contains sensitive personal information. How does categorization inform prioritization in this scenario?

   • AThe priority of 'High' determines the category, so the analyst should re-categorize the incident as 'Critical'.
   • BThe category 'Data Exfiltration' and the affected asset 'customer database' provide the context needed to assess impact and assign high priority.
   • CCategorization and prioritization are independent processes that do not influence each other.
   • DThe analyst should skip categorization and go straight to prioritization to save time.
   Reveal Solution Discussion Select an answer first