2.4 Explain the Function of Case Categorization and Prioritization SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which factors are typically used to prioritize security cases?

   • AAnalyst availability, tool licensing, and log retention
   • BIncident type, attack vector, and threat actor
   • CUrgency, criticality, and business impact
   • DCase number, date opened, and assigned analyst
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SOC categorizes an incident as 'Denial of Service' and assigns a priority of 'Medium'. However, the affected service is a customer-facing payment portal that is critical for revenue. The SOC manager is considering whether to re-categorize the incident as 'Business Critical' to justify a higher priority. What is the most appropriate action?

   • ARe-categorize the incident to 'Data Breach' because the payment portal may contain sensitive data.
   • BKeep the categorization and priority unchanged because the incident type is still a denial of service.
   • CKeep the categorization as 'Denial of Service' but increase the priority to 'High' based on business impact.
   • DRe-categorize the incident to 'Business Critical' and increase the priority to 'High' because the payment portal is critical to revenue.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC receives an alert about a potential SQL injection attack on a public-facing web application. The analyst needs to categorize the case to determine the appropriate response. Which categorization is most appropriate?

   • ACategorize as 'Web Application Attack' because the attack vector is the web application.
   • BCategorize as 'Data Breach' because SQL injection often leads to data exfiltration.
   • CCategorize as 'Insider Threat' because the attack may originate from an internal user.
   • DCategorize as 'Malware' because SQL injection is a type of malicious activity.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of categorizing a security case in an incident response workflow?

   • ATo assign a unique identifier to the case for tracking purposes
   • BTo automatically close low-severity cases without human review
   • CTo group cases by incident type, severity, and impact so they can be handled consistently and routed appropriately
   • DTo determine the exact root cause of the incident before any response actions are taken
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC receives two cases: one is a suspected data exfiltration from a research and development (R&D) server, and the other is a denial-of-service attack against a public website. The R&D server contains proprietary designs, and the website is used for marketing but is not revenue-critical. Which case should be prioritized?

   • APrioritize both equally because both are active incidents.
   • BThe denial-of-service case because it affects a public-facing service.
   • CThe data exfiltration case because the R&D server contains proprietary designs, which have high business impact.
   • DPrioritize the denial-of-service case because it is easier to resolve.
   Reveal Solution Discussion Select an answer first