HikeLetter | PMP Training & Certification Online Course | Project Management Learning

1

During SOC triage, consider: A SIEM flags repeated authentication failures followed by a successful login from an unfamiliar country. What should the analyst do first?

A. Correlate authentication logs with user context, device data, and other telemetry to validate the alert. B. Close the alert immediately without validating evidence. C. Disable monitoring across the environment to reduce noise. D. Assume the most severe explanation without checking context.

2

During SOC triage, consider: A critical server is vulnerable to a flaw with active exploitation. How should remediation be prioritized?

A. Assume the most severe explanation without checking context. B. Assess exploitability, exposure, asset criticality, and potential impact, then expedite an approved fix or mitigation. C. Close the alert immediately without validating evidence. D. Disable monitoring across the environment to reduce noise.

3

During SOC triage, consider: An endpoint detection tool identifies a suspicious process making unusual outbound connections. What is a sound next step?

A. Disable monitoring across the environment to reduce noise. B. Assume the most severe explanation without checking context. C. Investigate process ancestry, network destinations, endpoint telemetry, and threat intelligence before choosing containment actions. D. Close the alert immediately without validating evidence.

4

During SOC triage, consider: A security team has too many low-quality alerts. What is the best improvement?

A. Close the alert immediately without validating evidence. B. Disable monitoring across the environment to reduce noise. C. Assume the most severe explanation without checking context. D. Tune detection logic using validated incidents, false-positive analysis, asset context, and measurable outcomes.

5

During SOC triage, consider: An analyst suspects data exfiltration from a cloud workload. What evidence should be reviewed?

A. Identity and audit logs, network flows, object-access records, workload telemetry, and data-transfer patterns. B. Close the alert immediately without validating evidence. C. Disable monitoring across the environment to reduce noise. D. Assume the most severe explanation without checking context.

6

During SOC triage, consider: A newly disclosed vulnerability affects an internet-facing application. What should happen?

A. Assume the most severe explanation without checking context. B. Identify affected assets, validate exposure, prioritize based on risk, and apply a tested patch or compensating control. C. Close the alert immediately without validating evidence. D. Disable monitoring across the environment to reduce noise.

7

During SOC triage, consider: An incident may involve a compromised privileged account. What should be prioritized?

A. Disable monitoring across the environment to reduce noise. B. Assume the most severe explanation without checking context. C. Contain the account’s access, revoke active sessions or tokens as appropriate, and investigate privileged actions. D. Close the alert immediately without validating evidence.

8

During SOC triage, consider: A threat-hunting hypothesis suggests suspicious PowerShell use. What is the strongest approach?

A. Disable monitoring across the environment to reduce noise. B. Assume the most severe explanation without checking context. C. Search authorized endpoint and event telemetry for the hypothesis, then validate findings against expected administrative activity. D. Close the alert immediately without validating evidence.

9

During SOC triage, consider: A vulnerability scanner reports a critical issue on an isolated test system. What should guide priority?

A. Close the alert immediately without validating evidence. B. Disable monitoring across the environment to reduce noise. C. Assume the most severe explanation without checking context. D. Confirm the finding and consider reachability, business criticality, exploitability, and compensating controls.

10

During SOC triage, consider: A team needs to determine whether an alert represents a true incident. What should it do?

A. Collect and correlate relevant evidence, test competing explanations, and document the triage decision. B. Close the alert immediately without validating evidence. C. Disable monitoring across the environment to reduce noise. D. Assume the most severe explanation without checking context.

CySA+

Overview

Course Description

Course Questions