2.4 Explain the Function of Case Categorization and Prioritization SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC receives two cases: one is a suspected ransomware infection on a file server that is isolated from the network, and the other is a phishing email that was opened by the CEO's assistant, who has access to financial records. Which case should be prioritized?

   • AThe ransomware case because ransomware is always a critical threat.
   • BPrioritize the ransomware case because it is a more common attack type.
   • CPrioritize both equally because both involve potential data compromise.
   • DThe phishing case because the CEO's assistant has access to sensitive financial records, increasing business impact.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the main goal of prioritizing security cases?

   • ATo classify cases by incident type for reporting purposes
   • BTo ensure that all cases are resolved within the same timeframe
   • CTo identify the root cause of each incident
   • DTo determine the order in which cases are investigated and resolved
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC analyst categorizes an incident as 'Data Exfiltration' and assigns it a priority of 'High' based on the sensitivity of the data involved. Later, the incident is re-categorized as 'Insider Threat' after further investigation. What is the most appropriate action regarding the priority?

   • ARe-evaluate the priority because the new categorization may change the urgency and impact assessment.
   • BKeep the priority unchanged because the data sensitivity remains the same regardless of the category.
   • CEscalate the priority to 'Critical' because insider threats are always more severe.
   • DLower the priority because insider threats are always less urgent than external threats.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC is designing a categorization scheme to support both efficient response and regulatory reporting. They need to categorize incidents in a way that allows them to quickly identify cases that may require notification to data protection authorities. Which categorization scheme would best meet this need?

   • ACategorize by severity (e.g., low, medium, high).
   • BCategorize by affected asset (e.g., server, endpoint, network device).
   • CCategorize by attack vector (e.g., phishing, malware, DDoS).
   • DCategorize by data type (e.g., personal data, financial data, health data).
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How does case categorization differ from case prioritization?

   • ACategorization is automated; prioritization is always manual
   • BCategorization is performed after investigation; prioritization is performed before triage
   • CCategorization assigns a response order; prioritization groups cases by type
   • DCategorization groups cases by type and impact; prioritization determines the order of response
   Reveal Solution Discussion Select an answer first