HikeLetter | PMP Training & Certification Online Course | Project Management Learning

1

A security operations center receives thousands of alerts each day. Which capability helps analysts prioritize alerts and investigate related events efficiently?

A. Disable alert generation B. Correlate telemetry in a SIEM and apply risk-based triage C. Close alerts automatically without review D. Store every log only on the originating endpoint

2

A user account logs in from two distant locations within a short period. What should an analyst do first?

A. Immediately declare a confirmed breach without checking context B. Correlate identity logs, VPN/proxy data, device context, and authentication signals C. Delete the account's audit history D. Disable all remote access permanently

3

A detection rule generates repeated false positives for an approved vulnerability scanner. What is the best response?

A. Disable all SIEM rules B. Tune the rule using validated scanner context while preserving meaningful coverage C. Ignore every future alert D. Delete the scanner's logs

4

EDR reports suspicious PowerShell execution on a server. What should the analyst examine?

A. Command line, parent process, user, script content, network activity, and related events B. Only the server's wallpaper C. Only the hostname length D. The office printer model

5

A threat hunter suspects an attacker is using legitimate administration tools to move laterally. Which approach is best?

A. Search for anomalous use, unusual parent-child process relationships, and authentication patterns B. Block all administration tools everywhere without assessment C. Stop collecting endpoint telemetry D. Review only antivirus installation dates

6

Which telemetry can help identify beaconing to a command-and-control server?

A. Repeated outbound connections with regular timing and unusual destination context B. A list of monitor resolutions C. A printer's paper count D. Employee desk assignments

7

A user reports a suspicious email containing a link. What should the analyst do?

A. Inspect headers and URL safely, search for related messages, and determine whether anyone interacted B. Click the link from a production workstation C. Forward it to every employee without warning D. Delete all email security logs

8

A critical vulnerability alert affects an internet-facing server. How should the SOC prioritize it?

A. By severity alone with no context B. Assess exploitability, exposure, asset criticality, threat activity, and available mitigations C. Wait for the annual audit D. Ignore it if the server is old

9

An alert indicates likely ransomware execution on a business-critical server. What is the appropriate SOC action?

A. Follow escalation and incident-response procedures promptly and coordinate containment B. Close the alert because the server is important C. Erase evidence before contacting responders D. Wait until the next shift

10

Several failed logins are followed by a successful privileged login from an unfamiliar device. What should the analyst check?

A. Authentication method, MFA events, source reputation, device posture, and subsequent actions B. Only the account display name C. The user's monitor size D. Whether the user changed desktop wallpaper

Certified SOC Analyst (CSA)

Overview

Course Description

Course Questions