Question

After a security incident is verified in a SOC, an incident responder reviews the incident but cannot identify the source of the incident and form an effective mitigation procedure. To whom should the incident ticket be escalated?

a SME for further investigation
a cyberoperations analyst for help
an alert analyst for further analysis
the SOC manager to ask for other personnel to be assigned

Answer 1

Answer:

Option A i.e., SME for further investigation.

Explanation:

Following the reports of such a security incident into an SOC, an incident respondent examines the incident but could not determine the cause of that same incident as well as establish an appropriate response protocol. The ticket for an incident must be applied to SME for even more inquiry. So, the following answer is correct.