SAL1 Practice Questions - TryHackMe Security Analyst Level 1 (SAL1) Exam

Access More Questions

A SOC analyst receives an alert classified as 'High' severity in the SIEM. The alert was triggered by a single failed login attempt from an internal IP address. What is the most appropriate first action?

Immediately escalate to Tier 2 and close the ticket Investigate the alert's user, asset, and recent authentication context Block the source IP address at the firewall without further investigation Mark the alert as a True Positive and begin incident response procedures

Correct Answer:

Investigate the alert's user, asset, and recent authentication context

Access more questions from this quiz

Continue to SAL1 Practice Questions - TryHackMe Security Analyst Level 1 (SAL1) Exam for more practice questions and the full quiz experience.

Access More Questions