SAL1 Practice Questions - TryHackMe Security Analyst Level 1 (SAL1) Exam - SAL1 Practice Questions - TryHackMe Security Analyst Level 1 (SAL1) Exam

Question 1

A SOC analyst receives an alert classified as 'High' severity in the SIEM. The alert was triggered by a single failed login attempt from an internal IP address. What is the most appropriate first action?

Immediately escalate to Tier 2 and close the ticket Investigate the alert's user, asset, and recent authentication context Block the source IP address at the firewall without further investigation Mark the alert as a True Positive and begin incident response procedures

Correct Answer:

Investigate the alert's user, asset, and recent authentication context

Question 2

In the TryHackMe SOC Level 1 path, which framework ranks Indicators of Compromise (IoCs) by the level of difficulty they impose on an attacker when defenders detect and act on them?

MITRE ATT&CK Cyber Kill Chain Pyramid of Pain Unified Kill Chain

Correct Answer:

Pyramid of Pain

Question 3

An analyst examines a suspicious email and notes the 'From' display name shows 'IT Support ' but the actual 'Reply-To' header points to '[email protected]'. Which phishing technique is being used?

Sender spoofing with reply-to manipulation Typosquatting Spear phishing with malware attachment Business Email Compromise via account takeover

Correct Answer:

Sender spoofing with reply-to manipulation

Question 4

What does the SPF (Sender Policy Framework) DNS record do in email authentication?

Encrypts the email body using public key cryptography Adds a cryptographic digital signature to each outgoing email header Specifies which mail servers are authorized to send email on behalf of a domain Instructs receiving mail servers on how to handle emails that fail authentication checks

Correct Answer:

Specifies which mail servers are authorized to send email on behalf of a domain

Question 5

A SIEM alert fires for a successful authentication to an admin console from a known-clean internal IP at 2:14 AM on a weekend. The user account belongs to a software developer with no admin privileges. Which verdict is most appropriate?

False Positive — admin logins during off-hours are expected Informational — log the event and take no further action Benign True Positive — developer needed emergency access True Positive — credential compromise or unauthorized access is highly probable

Correct Answer:

True Positive — credential compromise or unauthorized access is highly probable

Exam overview

About this Exam

Prepare with the SAL1 Practice Questions - TryHackMe Security Analyst Level 1 (SAL1) Exam practice quiz. This question bank includes 100 questions covering analyst, alert, email, windows, and security. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

SAL1 Practice Questions - TryHackMe Security Analyst Level 1 (SAL1) Exam

This practice set contains 100 questions from the matching question bank and focuses on analyst, alert, email, windows, and security. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.

No fixed duration is currently configured for this quiz.

Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.

Yes. You can retake the practice test again as you continue studying during your available access period.

After your access is confirmed, you can continue into the complete practice exam from this quiz flow.

Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

About this Exam

Additional Information

SAL1 Practice Questions - TryHackMe Security Analyst Level 1 (SAL1) Exam

Frequently Asked Questions

Related Questions

ISC2 Certified in Cybersecurity Practice Exam

3F5X1 Admin 5-Level Practice Exam

68W LPC Level 2 Practice Exam

Pass Your A Level Biology Practice Exam

A Level Chemistry OCR Practice Exam

A Level Computer Science OCR Practice Exam