Question

During a busy shift, a SOC receives four concurrent alerts. The incident response plan requires analysts to triage based on business impact and containment urgency before assigning resources. Which alert should be classified as the highest severity and worked first?

Accepted Answer

An EDR alert showing active credential dumping (LSASS access) on a domain controller, with outbound connections to an unfamiliar IP already established

Answer

A single phishing email reported by one user who did not click the link, quarantined automatically by the mail gateway

Answer

A vulnerability scanner flagging a missing OS patch on three internal workstations rated CVSS 7.5

Answer

A firewall log showing repeated blocked inbound scans from an external IP against the DMZ perimeter