2.4 Explain the Function of Case Categorization and Prioritization SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following best describes the process of case categorization?

   • AClassifying a case according to incident type, severity, and impact to support consistent handling
   • BEscalating a case to a higher-tier analyst for immediate action
   • CAssigning a priority score based on the potential business impact of the incident
   • DDetermining the order in which cases should be investigated based on urgency
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a key benefit of effective case prioritization on response outcomes?

   • AIt allows high-impact cases to be addressed first, reducing potential damage
   • BIt ensures that all cases are resolved within the same timeframe
   • CIt eliminates the need for SLA tracking
   • DIt guarantees that no case is ever missed
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common categorization scheme for security cases?

   • ABy analyst name, shift time, or ticket number
   • BBy attack vector, affected asset, or threat type
   • CBy SLA, priority score, or escalation level
   • DBy log source, firewall model, or software version
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of a prioritization framework?

   • AGrouping cases by attack vector for trend analysis
   • BAssigning priority based on severity, SLA, or risk scoring
   • CCategorizing cases by affected asset type
   • DSorting cases alphabetically by incident type
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC is evaluating different categorization schemes to improve case management. They want a scheme that helps identify trends in attack patterns over time. Which categorization scheme would be most effective for this purpose?

   • ACategorize by severity (e.g., low, medium, high).
   • BCategorize by response team (e.g., network team, endpoint team).
   • CCategorize by affected asset (e.g., server, endpoint, network device).
   • DCategorize by threat type (e.g., malware, phishing, DDoS).
   Reveal Solution Discussion Select an answer first