Security Event Triage and Prioritization

5 minutes 5 Questions

Test mode:
Start practice test

CC - Security Event Triage and Prioritization Example Questions

Test your knowledge of Security Event Triage and Prioritization

Question 1

A security analyst reviews four active alerts during a shift: a failed login on an unused test account, a malware alert on a workstation holding sensitive customer records, a spam email quarantined by the filter, and a printer offline notice. With limited time, which alert should the analyst work on first?

Correct Answer: The malware alert affecting the workstation that stores sensitive customer records

The malware alert on a workstation holding sensitive customer records is right because it represents an active threat against high-value, confidential data, combining both high impact and urgency.

The failed login on an unused test account is low risk since the account is inactive and holds no value. The spam email is already contained by the filter, so no active threat remains. The printer offline notice is an availability nuisance, not a security incident.

The key concept tested is risk-based prioritization, focusing on the alert with the greatest potential impact to confidentiality and the most sensitive assets.

Question 2

A security analyst receives an alert detailing twenty consecutive failed authentication attempts against a critical financial database within a two-minute window. To accurately prioritize this alert, the analyst must determine if the event represents a coordinated brute-force attack or a single authorized user entering an incorrect credential repeatedly. Which piece of contextual data is most critical to review to establish this distinction?

Correct Answer: The geographic distribution and variety of the source network addresses involved.

Reviewing the source network addresses allows the analyst to determine if the attempts originate from a single location, suggesting a user making a mistake, or multiple distributed locations, indicating a coordinated brute-force attack.
Historical password complexity policies do not provide context on the origin or nature of current failed attempts. Remaining storage capacity on the logging drive is an operational metric irrelevant to analyzing the security incident itself. Time zone synchronization settings do not help differentiate between an honest user error and an active threat.
The key concept tested is analyzing security events using contextual data.

Question 3

A security analyst is triaging alerts and notices that a specific server keeps generating the same low-level alert every few minutes throughout the day, always tied to a routine backup process. This repetitive noise is slowing down review of other alerts. What is the best way to handle this ongoing situation?

Correct Answer: Create a tuning rule so the known benign backup activity stops flooding the queue

Creating a tuning rule to suppress or filter known benign activity reduces alert fatigue and lets analysts focus on meaningful events, which is the proper handling of confirmed false positives.

Raising severity would worsen the noise and misrepresent risk. Escalating each alert to incident response wastes resources on routine, expected behavior. Reclassifying it as a confirmed incident is inaccurate because a scheduled backup is legitimate, not a security event.

Key concept: alert tuning to reduce false positives and combat alert fatigue.

More Security Event Triage and Prioritization questions
42 questions (total)
Start 42 question test

Other Domain 5: Security Operations and Incident Response concepts

Acceptable Use and BYOD PoliciesAsset Lifecycle Management and EOLAsymmetric EncryptionChange Management PolicyConfiguration Management and Patch ManagementData Classification and LabelingData Destruction and SanitizationData Handling and Retention PoliciesHashing AlgorithmsIncident Containment and EradicationIncident Detection and ReportingIncident Response Exercises and TabletopsIncident Response LifecycleIncident Response PlanningLessons Learned and Post-Incident ReviewPassword Policies and Best PracticesPrivacy Policy FundamentalsQuantum-Resistant Cryptography ConceptsSecurity Event Logging and MonitoringSecurity Testing: Red, Blue, and Purple TeamingSymmetric EncryptionSystem Hardening and BaselinesThreat Actors and Cyber Threat IntelligenceThreat Frameworks (MITRE ATT&CK, Cyber Kill Chain)
All Domain 5: Security Operations and Incident Response questions · CC practice test