312-39 · Question #75
At 9:15 AM EST, Marcus Wong, a financial operations analyst, contacts the SOC after noticing Excel spreadsheets automatically encrypting with unusual file extensions (e.g., .locked or .crypt). The…
The correct answer is C. Incident recording and assignment. The scenario describes creating a ticket and escalating/assigning it to the appropriate analyst, which is incident recording and assignment. This phase is where the SOC formally documents the reported event, creates an incident record in the tracking system (often SIEM/SOAR or…
Question
At 9:15 AM EST, Marcus Wong, a financial operations analyst, contacts the SOC after noticing Excel spreadsheets automatically encrypting with unusual file extensions (e.g., .locked or .crypt). The Tier 1 analyst logs the incident as ticket #INC-89271 in the SIEM and escalates it to a Tier 2 SOC analyst for investigation. Which phase of the Incident Response process is currently taking place?
Options
- AContainment
- BIncident triage
- CIncident recording and assignment
- DNotification
How the community answered
(24 responses)- A4% (1)
- C88% (21)
- D8% (2)
Explanation
The scenario describes creating a ticket and escalating/assigning it to the appropriate analyst, which is incident recording and assignment. This phase is where the SOC formally documents the reported event, creates an incident record in the tracking system (often SIEM/SOAR or ticketing), sets initial severity/priority, and assigns ownership for investigation. While triage will follow quickly (or may begin in parallel), the explicit action described is logging the incident as a ticket and escalating it to Tier 2. Containment would involve actions to stop spread (isolate endpoint, block C2, disable accounts), which are not described yet. Notification refers to informing broader stakeholders (management, legal, IT) and is not the focus here. From a SOC workflow standpoint, accurate incident recording and assignment is crucial because it ensures accountability, preserves initial report details (time, symptoms, impacted user/device), and triggers SLA-driven response processes. Once assigned, the Tier 2 analyst will conduct triage and verification, then drive containment and eradication if ransomware is confirmed.
Topics
Community Discussion
No community discussion yet for this question.