Security Operations

During a busy shift the SOC receives 4,000 alerts. An AI triage augmentation layer groups and ranks them, surfacing 30 high-priority clusters for human review. A junior analyst asks how the team should treat the AI's ranking. What is the BEST guidance?

• AAuto-close every alert the AI ranked as low priority to clear the queue quickly.
• BIgnore the AI ranking entirely and triage all 4,000 alerts in the original order they arrived.
• CUse the ranking to prioritise which clusters analysts review first, while keeping human judgement as the decision-maker on each verdict.check_circle Correct
• DEscalate all 30 high-priority clusters straight to incident response before any analyst reviews them.

Why A is wrong: Auto-closing low-ranked alerts is tempting for throughput, but the model can misrank a genuine threat, and closing without review removes any chance of catching that error.

Why B is wrong: Discarding the augmentation defeats its purpose and is impractical at this volume, though the caution about not blindly trusting the model is partly reasonable.

Why C is correct: Alert-triage augmentation is meant to prioritise and reduce load while the analyst still confirms verdicts, which correctly balances efficiency against the model's fallibility.

Why D is wrong: Escalating on the model's ranking alone skips triage and risks flooding incident response with false positives, since a high rank is a prioritisation hint, not a confirmed incident.

A SOC uses a supervised model trained on analyst-labelled alerts to auto-classify incoming events. Over two weeks the model's false-negative rate climbs sharply, and review shows an external contributor has been submitting mislabelled benign samples that resemble known malware beacons into the training feedback loop. Which threat does this pattern BEST describe?

• AData poisoning, where crafted mislabelled samples corrupt the training set so the model learns to misclassify malicious activity.check_circle Correct
• BModel inversion, where an attacker reconstructs the private training data by repeatedly querying the deployed model.
• CPrompt injection, where malicious instructions embedded in input manipulate a language model's response.
• DDenial of service, where a flood of events exhausts the classifier's processing capacity.

Why A is correct: Injecting deceptive labelled samples into the training loop to degrade future classifications is the defining mechanism of a data-poisoning attack against a machine-learning model.

Why B is wrong: Model inversion is a real adversarial-AI risk, but it extracts information from a model rather than corrupting its training data, so it does not explain a rising false-negative rate.

Why C is wrong: Prompt injection targets generative language models through crafted input at inference time, not a supervised classifier being degraded through its training feedback loop.

Why D is wrong: A resource-exhaustion flood would slow or stop classification, but here the model still runs and simply misclassifies, which points to corrupted training data rather than lost availability.

An analyst reviews an authentication alert: one service account authenticated successfully from Perth and, seven minutes later, successfully from Frankfurt, a journey no traveller could make. Both events show valid credentials and no failed attempts. What does this evidence most strongly indicate?

08:01 SUCCESS user=svc-billing srcgeo=Perth,AU result=0
08:08 SUCCESS user=svc-billing srcgeo=Frankfurt,DE result=0

• AA brute-force attack is in progress and the account should be locked after the next failed attempt threshold is reached.
• BTwo successful logins from geographically impossible locations point to compromised credentials, so the account should be disabled and investigated.check_circle Correct
• CThe alert is a benign false positive caused by a VPN, so it can be closed without any further review of the account.
• DA password-spray campaign has succeeded across many accounts and every user in the tenant must reset immediately.

Why A is wrong: Brute force is tempting given the security context, but the logs show zero failures and both logins succeeded, which is the opposite of guessing attempts.

Why B is correct: Valid authentications from locations too far apart to travel between are the textbook impossible-travel indicator of credential theft, making containment of the account and investigation the correct response.

Why C is wrong: A VPN can explain unexpected geolocation, but closing outright without confirming the account's expected egress is premature and would dismiss a strong compromise signal.

Why D is wrong: Spraying is plausible language, but the evidence covers a single account with no breadth across users, so a tenant-wide reset overreaches what the data supports.

An analyst submits a downloaded installer hash to a reputation service and gets the result below. The file is already present on twelve endpoints. What is the most defensible next step?

sha256: 9f2c...e11a
detections: 3/72 engines (2 generic heuristic, 1 PUA)
first_seen: 6 hours ago   signed: yes (valid cert, unknown publisher)
prevalence: low (first submission in your tenant)

• ACollect a sample and detonate it in a sandbox while scoping the twelve hosts, since low prevalence and heuristic hits are inconclusive.check_circle Correct
• BImmediately reimage all twelve endpoints, because any non-zero detection count confirms an active infection.
• CClear the file as safe, because 69 of 72 engines did not flag it and it carries a valid signature.
• DAdd the publisher certificate to the global block list to stop all software it has ever signed.

Why A is correct: Mixed low-confidence detections on a rare, newly seen signed file are ambiguous, so dynamic analysis plus scoping gathers the behavioural evidence needed before any containment decision.

Why B is wrong: Non-zero detections feel like proof, but three low-confidence heuristic and PUA hits on a fresh signed file are not confirmation, and mass reimaging is disproportionate to this evidence.

Why C is wrong: A mostly clean score and a valid signature are reassuring, but a valid certificate from an unknown publisher plus very low prevalence and recent first-seen are exactly the traits of a new malicious file.

Why D is wrong: Blocking the signer looks decisive, but an unknown publisher may also sign legitimate tools, and a broad certificate block risks outages without first confirming the file is malicious.

Your organisation runs a zero trust access model. A SIEM alert fires when a contractor account authenticates successfully to an internal finance app from a managed device, but the device posture check reports its endpoint agent is disabled. The access proxy granted the session anyway. As the analyst, what is the BEST immediate interpretation of this evidence?

auth=success user=contractor7 app=finance-portal
device_posture=FAIL (endpoint_agent=disabled) decision=ALLOW

• AThe account is confirmed malicious because a failed posture check that still allowed access can only mean stolen contractor credentials in active use.
• BThe session is acceptable because authentication succeeded, and in zero trust a valid identity is sufficient to authorise access to the resource.
• CThe access decision contradicts the posture result, indicating the proxy did not enforce device trust, so the enforcement gap should be investigated and the session scrutinised.check_circle Correct
• DThe alert is informational and can be suppressed, since contractor accounts routinely fail posture checks and the proxy compensates automatically.

Why A is wrong: Tempting because a posture failure is alarming, but the evidence shows a policy-enforcement gap, not confirmed credential theft; concluding malice skips the triage that would establish it.

Why B is wrong: Tempting because identity is central to zero trust, but the model requires continuous verification of device posture too, so a failed posture that was still allowed is a defect rather than acceptable.

Why C is correct: Correct: zero trust conditions access on device posture as well as identity, so an ALLOW despite a posture FAIL is an enforcement gap the analyst should investigate while scrutinising the session.

Why D is wrong: Tempting because posture noise from unmanaged contractors is common, but here the policy allowed access it should have blocked, which is a meaningful control failure rather than expected noise.