312-39V2: Certified SOC Analyst v2

Question

If the SIEM produces the following four alerts simultaneously:

I) Firewall alerts indicating that traffic is being blocked from entering the network

II) SQL injection-attempt alerts

III) Data-deletion-attempt alerts

IV) Brute-force-attempt alerts

Which alert should receive the lowest priority under effective alert triage?

Explanation

Alerts showing that the firewall has already blocked inbound traffic generally have the lowest priority because the preventive control has successfully stopped the attempted access. SQL injection, data-deletion, and brute-force alerts can indicate attacks that require more immediate investigation.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ113

Community Discussion