SOC English Lab

Compreensão

1. 1. What made the analyst suspicious about the alert?

   The user logged in from two countries seven minutes apartThe queue had forty-two itemsA scan failed twiceThe EDR tool went offline

2. 2. What did the analyst do after noticing the alert?

   Closed it as a false positive immediatelyPulled the log and pivoted into the EDR toolEscalated straight to the SOC managerIgnored it until the next shift