CCDL2 Practice Questions - Certified CyberDefender Level 2 (CCDL2, Formerly CCD) Exam

Access More Questions

In a SOC environment, a Tier 1 analyst receives an alert for a suspicious outbound connection on port 443 to an unknown IP. After verifying the IP is flagged as malicious in threat intelligence feeds, what is the MOST appropriate immediate next step?

Escalate to Tier 2/3 with full context, preserve evidence, and initiate the incident response process Block the IP at the firewall and close the alert as resolved Notify the end user and ask them to restart their machine Wait 24 hours to gather more alerts before taking action

Correct Answer:

Escalate to Tier 2/3 with full context, preserve evidence, and initiate the incident response process

Access more questions from this quiz

Continue to CCDL2 Practice Questions - Certified CyberDefender Level 2 (CCDL2, formerly CCD) Exam for more practice questions and the full quiz experience.

Access More Questions