Sample questions
Bt Incident Triage ClassificationDifficulty 1
A SOC analyst just received a new alert in the queue. What is the primary goal of the triage step, before any deep investigation begins?
- aQuickly decide whether the alert deserves further investigation, and how urgently.✓
- bImmediately notify the CEO, regardless of what kind of alert it is.
- cClose the alert permanently without review, to keep the queue empty.
- dRewrite the detection rule that generated the alert before looking at anything else.
Explanation:Triage is a fast initial assessment: is this alert worth investigating, and how soon? It is not the deep investigation itself, and it is not a reason to skip review or jump straight into rule engineering.
Bt Incident Triage ClassificationDifficulty 1
In SOC terminology, how does an alert's "severity" differ from its "priority" during triage?
- aSeverity reflects the potential technical impact if the underlying issue is real, while priority also weighs urgency and available responder capacity to decide handling order.✓
- bThey are exactly the same concept, and SOC teams use the two words interchangeably with no distinction.
- cSeverity is set only by the CEO, while priority is generated automatically and cannot be adjusted by analysts.
- dPriority always overrides severity, so severity ratings can safely be ignored once a priority is assigned.
Explanation:Severity describes how bad the underlying issue would be if confirmed. Priority combines that severity with urgency and current responder capacity to decide what gets worked on first — a high-severity alert on an idle queue and the same alert during a major incident may still get different priority treatment.
Bt Incident Triage ClassificationDifficulty 2
When scoring the severity of a suspicious login alert, why does the criticality of the affected asset (for example, a domain controller versus a test printer server) matter?
- aIt does not matter; every asset in the environment is treated as equally important during triage by definition, since severity frameworks are designed to never account for what data or business function a system supports.
- bAsset criticality only matters for billing purposes and has no bearing on how an alert is triaged.
- cThe same suspicious behavior on a more critical asset carries higher potential impact, so it should generally be scored more severely.✓
- dA test asset should always receive higher severity, since test environments are inherently less monitored.
Explanation:Severity scoring is not just about the technique observed — it also reflects what could be lost or affected if the alert turns out to be real. The same login anomaly on a domain controller has far greater potential blast radius than on a low-value test system.
Bt Incident Triage ClassificationDifficulty 2
During initial triage of a new alert, which basic set of questions should an analyst try to answer first?
- aWhich vendor sells the best SIEM product on the market this year.
- bHow many years the analyst assigned to the alert has worked at the company, since tenure alone is assumed to fully substitute for checking the alert's actual technical details.
- cWhat color scheme the SOC dashboard uses to display the alert.
- dWhat triggered the alert, which asset and user are involved, and whether the pattern looks expected or anomalous.✓
Explanation:Effective triage starts with concrete context: what fired, which asset/user is involved, and whether the observed pattern is normal for that context. These answers drive the severity and priority decision; the other options are irrelevant to the triage itself.
Bt Incident Triage ClassificationDifficulty 2
An analyst investigates an alert and confirms the flagged activity was a scheduled vulnerability scan run by the internal security team, not an attacker. How should this alert be classified?
- aA confirmed true positive incident requiring full incident response activation.
- bA false positive for this alert instance, since the underlying activity was expected and authorized.✓
- cAn unresolved alert that must stay open indefinitely until an attacker is eventually identified, since authorized activity can never be the reason a detection rule fires in the first place.
- dA critical zero-day exploit that bypasses all existing detection controls.
Explanation:When the activity is confirmed to be legitimate and expected (an authorized scan), the alert instance is a false positive — the detection fired correctly but on benign activity. It should be documented and closed, not escalated as an incident.
Bt Incident Triage ClassificationDifficulty 2
What is "alert fatigue" in a SOC context?
- aA software feature that automatically deletes alerts older than 24 hours regardless of status, intended purely to keep dashboard storage usage low rather than to reflect anything about analyst behavior.
- bA formal certification that SOC analysts must renew every year to keep working night shifts.
- cA state where analysts become desensitized to a high volume of low-value alerts, increasing the risk of missing a genuine incident.✓
- dA metric that measures how many hours an analyst has slept the night before their shift.
Explanation:Alert fatigue happens when analysts are overwhelmed by noisy, mostly-benign alerts and start treating everything with less scrutiny — which raises the risk that a real incident hiding in the noise gets missed or delayed.