312-39 practice question 6 of 35

Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket raised regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he has performed incident analysis and validation to check whether the incident is a true incident or a false positive. Identify the stage in which he is currently in.

Full set: 100 questions

Answer options

A: Post-Incident Activities

B: Incident Recording and Assignment

C: Incident Triage Correct answer

D: Incident Disclosure

Correct Answer:

C. Incident Triage

Explanation

Mike is in the Incident Triage stage. This phase of incident handling occurs after an incident has been recorded and assigned. The primary purpose of triage is to perform an initial investigation to validate the alert, determining if it represents a genuine security incident (a true positive) or a false alarm (a false positive). This stage also involves assessing the incident's priority and impact to determine the urgency and level of response required. Mike's actions of analysis and validation are the core activities of incident triage.

Why Incorrect

A. Post-Incident Activities occur after the incident has been fully resolved and include creating reports, documenting lessons learned, and improving security controls.
B. Incident Recording and Assignment is the administrative step of logging the initial alert and assigning it to an analyst, which happens before triage.
D. Incident Disclosure is the process of communicating information about a confirmed incident to relevant stakeholders, which occurs after triage and validation.

References

1. Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). National Institute of Standards and Technology. Section 2.3.2, Page 12. The "Detection & Analysis" phase involves analyzing precursors and indications, which includes validating alerts. Triage is the operational term for this initial validation and prioritization.

2. EC-Council. (2020). Certified SOC Analyst (CSA) v3.1 Courseware, Module 02: SOC Operations. This module details the incident handling process, identifying Triage as the stage for validating, prioritizing, and categorizing incidents immediately after they are recorded.

Question breakdown

Tests: Identify phases of the EC-Council incident handling process
Difficulty: Easy

Key idea: Incident triage is the phase where a reported incident is analyzed, validated as true or false positive, classified and prioritized.

How to reach the answer

The clue is 'analysis and validation to check whether the incident is a true incident or a false positive.'
Recording and assignment comes first and only logs the ticket and assigns a handler, which already happened here.
Validation, classification and prioritization all belong to triage in the EC-Council IH&R flow.
Disclosure and post-incident activities happen after containment and eradication, so they come too late.

Each option

AIncorrect. Post-incident activities cover documentation, lessons learned and policy review after the incident is resolved, not initial validation.
BIncorrect. Recording and assignment is when the ticket is logged and given to a handler, which happened before Mike started analysis.
CCorrect. Triage is where the handler analyzes and validates the alert to decide whether it is a real incident or a false positive, then prioritizes it.
DIncorrect. Incident disclosure is about notifying stakeholders, authorities or the public, not technically validating the event.

Common trap: Since the ticket was just raised and assigned, candidates may stop at 'Recording and Assignment' even though the activity described is validation.

In practice: SOC L1/L2 analysts triage SIEM alerts daily, confirming true positives and escalating them with a severity before response begins.

Remember: Validating true versus false positive and prioritizing the event is triage.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free 312-39 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test