CCP SOC Operations & Alert Triage 3 — Questions and Answers
Question 1: An analyst notices PowerShell commands with Base64-encoded arguments in endpoint logs. What is the MOST appropriate immediate action?
- Delete the PowerShell executable from the host
- Isolate the host and escalate for deeper investigation (Correct answer)
- Whitelist the encoded command to suppress future alerts
- Restart the affected system
Correct answer: Isolate the host and escalate for deeper investigation
Base64-encoded PowerShell is a common obfuscation technique used by attackers, warranting host isolation and escalation to prevent further compromise.
Question 2: Which framework is MOST commonly used by SOC teams to map adversary tactics and techniques during alert triage?
- OWASP Top 10
- MITRE ATT&CK (Correct answer)
- ISO 27001
- NIST CSF
Correct answer: MITRE ATT&CK
MITRE ATT&CK provides a structured knowledge base of adversary tactics and techniques that SOC teams use to classify and contextualize observed behaviors.
Question 3: A SOC receives an alert that a user downloaded an executable from a file-sharing site. Which data source BEST helps determine if the file is malicious?
- Active Directory group membership logs
- Threat intelligence feed and file hash lookup (Correct answer)
- Network bandwidth utilization report
- User's email inbox contents
Correct answer: Threat intelligence feed and file hash lookup
Cross-referencing the file's hash against threat intelligence feeds and reputation databases provides rapid malware classification.
Question 4: What does 'dwell time' refer to in the context of SOC operations?
- Time an analyst spends per alert
- Duration between initial compromise and threat detection (Correct answer)
- Time required to patch a vulnerability
- Length of a SOC analyst's shift
Correct answer: Duration between initial compromise and threat detection
Dwell time is the period an attacker remains undetected within a network after initial compromise, and reducing it is a key SOC goal.
Question 5: Which type of analysis involves examining the behavior of a suspicious file in a controlled, isolated environment?
- Static analysis
- Dynamic (sandbox) analysis (Correct answer)
- Memory forensics
- Log correlation
Correct answer: Dynamic (sandbox) analysis
Dynamic or sandbox analysis executes the suspicious file in an isolated environment to observe its runtime behavior without risking production systems.
Question 6: During triage, an analyst identifies an internal host communicating with a known C2 IP address. What is the recommended FIRST step?
- Wipe and reimage the host immediately
- Block the C2 IP at the perimeter and isolate the host for investigation (Correct answer)
- Send an email notification to the user
- Increase logging verbosity on the host
Correct answer: Block the C2 IP at the perimeter and isolate the host for investigation
Blocking the C2 channel at the perimeter cuts the attacker's control while isolating the host prevents further internal spread.
Question 7: Which SOC tier is PRIMARILY responsible for initial alert monitoring and triage?
- Tier 3 (Threat Hunting)
- Tier 1 (Level 1 Analyst) (Correct answer)
- Tier 2 (Incident Responder)
- Red Team
Correct answer: Tier 1 (Level 1 Analyst)
Tier 1 analysts perform initial alert monitoring, triaging incoming events and escalating confirmed or suspicious incidents to higher tiers.
CCP SOC Operations & Alert Triage 3
An analyst notices PowerShell commands with Base64-encoded arguments in endpoint logs.
What is the MOST appropriate immediate action?