2.4 Explain the Function of Case Categorization and Prioritization SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC has limited staff and must respond to two incidents: (1) a ransomware infection on a file server that is isolated but contains critical business data, and (2) a phishing campaign that has compromised several user accounts, including one with administrative privileges. The phishing campaign is ongoing, and the attacker is actively using the compromised admin account. Which incident should be prioritized?

   • AThe phishing incident because the attacker is actively using an admin account, enabling further compromise.
   • BThe ransomware incident because it involves critical data and potential data loss.
   • CPrioritize the ransomware incident because it is a more common attack.
   • DPrioritize both equally because both involve critical assets.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why does categorization inform prioritization decisions?

   • ABecause categorization is optional, and prioritization only works when categorization is skipped
   • BBecause categorization automatically resolves cases, so prioritization is only for reporting
   • CBecause categorization provides the classification details needed to assess urgency and impact
   • DBecause categorization determines the exact financial loss, which prioritization uses to calculate SLA
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC uses a categorization scheme based on the affected asset type (e.g., server, endpoint, network device). An analyst receives an alert about unusual outbound traffic from a database server. Using this scheme, what is the primary benefit of categorizing this case as 'Server'?

   • AIt allows the SOC to apply asset-specific playbooks and response procedures.
   • BIt immediately identifies the response team with the relevant expertise, such as server administrators.
   • CIt automatically determines the priority of the case based on the asset type.
   • DIt ensures the case is reported to regulatory authorities if the asset is a server.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC has implemented a new categorization and prioritization process. After a month, they notice that response times have improved and that critical incidents are being handled more quickly. What is the most likely reason for this improvement?

   • AThe process allows the SOC to focus resources on the most impactful incidents first.
   • BThe process automatically resolves incidents without analyst intervention.
   • CThe process ensures that all incidents are handled in the order they are received.
   • DThe process reduces the number of incidents reported.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC uses a prioritization framework that assigns priority based on the SLA for the incident type. A case is categorized as 'Phishing' with a 4-hour SLA. However, the phishing email was sent to the CEO and the CFO, and the attachment was opened by the CEO. The SOC manager is deciding whether to override the SLA-based priority. What is the most appropriate action?

   • AWait for the SLA to expire before escalating.
   • BKeep the priority based on the SLA because the categorization is 'Phishing'.
   • CRe-categorize the case as 'Executive Targeting' to justify a higher priority.
   • DOverride the priority to 'High' because the CEO opened the attachment, increasing the business impact.
   Reveal Solution Discussion Select an answer first