312-39V2: Certified SOC Analyst v2

Question

Charline works as an L2 SOC Analyst. One day, an L1 SOC Analyst escalates an incident to her for additional investigation and confirmation. After conducting a thorough investigation, Charline confirms the incident and assigns it an initial priority. According to the SOC workflow, what should she do next?

Explanation

A confirmed, prioritized security incident should be formally recorded and passed to the Incident Response Team (IRT) so that response, containment, remediation, and required communications can be coordinated through the established incident-management process.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ141

Community Discussion