312-39V2: Certified SOC Analyst v2

Question

Jennifer, a SOC analyst, begins an investigation after receiving an alert of potentially unauthorized activity on Marcus's workstation. She first retrieves EDR logs from the endpoint, analyzes network-traffic patterns in the Security Information and Event Management (SIEM) system, and examines email gateway logs for indications of malicious attachments. Her goal is to determine whether the alert is a legitimate security incident. In which Incident Response phase is Jennifer currently operating?

Explanation

Incident triage involves reviewing available evidence and assessing an alert to establish whether it is a true security incident. Initial EDR, SIEM network-traffic, and email-gateway log analysis supports that validation and prioritization decision.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ4

Community Discussion