2.4 Explain the Function of Case Categorization and Prioritization SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   How does a risk-scoring framework help prioritize cases?

   • ABy automatically resolving cases that score below a threshold
   • BBy categorizing cases into attack vector groups for reporting
   • CBy assigning cases to analysts based on their skill level
   • DBy assigning a numerical score based on factors like likelihood and impact, which is used to rank cases
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC analyst receives an alert about a suspicious PowerShell command execution on a workstation. The analyst needs to categorize the case. Which categorization is most appropriate?

   • ACategorize as 'Data Exfiltration' because PowerShell can be used to send data.
   • BCategorize as 'Malware' because PowerShell can be used to download malware.
   • CCategorize as 'Suspicious Activity' because the behavior is not yet confirmed as malicious.
   • DCategorize as 'Lateral Movement' because PowerShell is often used for that purpose.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How does effective case categorization improve incident response workflow efficiency?

   • ABy allowing cases to be routed to the appropriate team and handled with consistent procedures
   • BBy eliminating the need for human analysts in the response process
   • CBy automatically closing cases that are categorized as low severity
   • DBy ensuring that all cases are handled identically regardless of type
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the role of categorization schemes in case management?

   • ATo automatically resolve cases based on their category
   • BTo assign a unique priority level to each case
   • CTo replace the need for human analysis in incident response
   • DTo organize cases into meaningful groups for consistent handling and analysis
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC uses an SLA-based prioritization framework where response time targets are defined by case priority. A case is categorized as 'Phishing' and assigned a priority of 'Medium' with an SLA of 4 hours. However, the phishing email contains a malicious attachment that was opened by a user in the finance department. What should the analyst do?

   • AChange the categorization to 'Malware' because the attachment is malicious.
   • BWait for the SLA to expire before escalating.
   • CRe-evaluate the priority to 'High' because the user opened the attachment and is in a sensitive department.
   • DKeep the priority as 'Medium' because the categorization is 'Phishing'.
   Reveal Solution Discussion Select an answer first