Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket raised regarding a critical incident and Mike was assigned to handle…

Question breakdown

Tests

Identify phases of the EC-Council incident handling process

Difficulty

Easy

Key idea: Incident triage is the phase where a reported incident is analyzed, validated as true or false positive, classified and prioritized.

How to reach the answer

1. The clue is 'analysis and validation to check whether the incident is a true incident or a false positive.'
2. Recording and assignment comes first and only logs the ticket and assigns a handler, which already happened here.
3. Validation, classification and prioritization all belong to triage in the EC-Council IH&R flow.
4. Disclosure and post-incident activities happen after containment and eradication, so they come too late.

Each option

• AIncorrect. Post-incident activities cover documentation, lessons learned and policy review after the incident is resolved, not initial validation.
• BIncorrect. Recording and assignment is when the ticket is logged and given to a handler, which happened before Mike started analysis.
• CCorrect. Triage is where the handler analyzes and validates the alert to decide whether it is a real incident or a false positive, then prioritizes it.
• DIncorrect. Incident disclosure is about notifying stakeholders, authorities or the public, not technically validating the event.

Common trap: Since the ticket was just raised and assigned, candidates may stop at 'Recording and Assignment' even though the activity described is validation.

In practice: SOC L1/L2 analysts triage SIEM alerts daily, confirming true positives and escalating them with a severity before response begins.

Remember: Validating true versus false positive and prioritizing the event is triage.

Drafted with AI assistance and checked against the answer key.