Refer to the exhibit. Which statement about the displayed event is correct?

The correct answer is C. The security event risk is considered open. Unhandled: The security event risk is not mitigated or contained, so it is considered open. For example, an IPS/AV log with action=pass will have the event status Unhandled. Botnet and IoC events are also considered Unhandled.

SOC Operations

Question

Exhibit

Options

AThe risk source is isolated.
BThe security risk was blocked or dropped.
CThe security event risk is considered open.
DAn incident was created from this event.

How the community answered

(21 responses)

A
5% (1)
B
5% (1)
C
90% (19)

Explanation

Unhandled: The security event risk is not mitigated or contained, so it is considered open. For example, an IPS/AV log with action=pass will have the event status Unhandled. Botnet and IoC events are also considered Unhandled.

Topics

#event status#security risk#SOC dashboard#incident management

Community Discussion

No community discussion yet for this question.

Full FCP_FAZ_AN-7.6 Practice