Cisco Certified Support Technician (CCST) CybersecurityIncident HandlingMedium
A security operations center (SOC) receives multiple alerts indicating a potential brute-force attack against an organization's VPN gateway. The team needs to quickly determine which alerts are critical and require immediate attention versus those that can be handled with lower priority. Which incident handling concept is most crucial in this scenario?
- AHot Wash
- BForensic Imaging
- CChain of Custody
- DIncident Prioritization
Show answer & explanationAnswer & explanation
Correct answer: D. Incident Prioritization
In a situation with multiple alerts and limited resources, determining which incidents pose the greatest risk and require the most urgent response is essential. This is the core of incident prioritization.
Why the other options are wrong
- A. A Hot Wash is a post-incident review, not for initial triage.
- B. Forensic Imaging is an evidence collection technique, not a prioritization concept.
- C. Chain of Custody is for evidence handling, not alert triage.
Incident Prioritization
The process of ranking security incidents based on their potential impact, urgency, and severity to determine the order of response.
- Considers factors like data sensitivity, system criticality, and attack severity.
- Helps allocate limited incident response resources efficiently.
- Often uses a scoring system or predefined criteria.
Memory trick: Prioritize alerts like traffic lights: Red for urgent, Yellow for caution, Green for go later.