Exam 312-39 topic 1 question 75 discussion

Actual exam question from ECCouncil's 312-39

Question #: 75
Topic #: 1

Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket raised regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he has performed incident analysis and validation to check whether the incident is a true incident or a false positive.
Identify the stage in which he is currently in.

A. Post-Incident Activities
B. Incident Recording and Assignment
C. Incident Triage
D. Incident Disclosure

Show Suggested Answer

Suggested Answer: B 🗳️

by l3arner at Oct. 30, 2023, 3:30 p.m.

Comments

Submit Cancel

Berro_b

1 month, 2 weeks ago

Selected Answer: B

p.707 Incident Recording in SOC In the process of alert triaging, the SOC L1 analyst determines whether the alert is true positive or merely false positive. If he/she confirms that alert raised is a true incident, he then escalates it to the L2 level analyst to perform initial investigation, classification, and prioritization.

upvoted 1 times

...

acumbajin

1 month, 4 weeks ago

Selected Answer: C

In the incident response process flow Fig 6.4 pg 407, it is shown that triage is performed, the analysis and validation of the incident is performed, and it is discarded as F+ or classified with its priority.

upvoted 1 times

...