SOC Simulation: Incident Workflow & Containment
Navigate standard SOC Tier 2 operational workflows. Learn when to escalate, when to contain, and how Role-Based Access Control (RBAC) dictates your next move during an active incident.
Scenario Context
You are shadowing Charline, a Tier 2 (L2) SOC Analyst at a large healthcare provider. Earlier today, a Tier 1 (L1) analyst noticed anomalous outbound HTTPS traffic from a critical database server and escalated the ticket to Charline's queue for deeper investigation.
Charline performed a thorough packet analysis and confirmed that the traffic is a Cobalt Strike C2 beacon. She immediately updated the incident ticket, confirming it as a True Positive, and assigned it a CRITICAL priority because the affected host contains Electronic Health Records (EHR).
The threat is active. Charline has finished the Detection & Analysis phase. Due to strict Separation of Duties (SoD) policies in the SOC, analysts do not have write-access to the core Cisco firewalls or VMware vSphere environments.
Security Environment: Ticketing & Telemetry
[14:10:05] L1_Analyst: Escalating to L2. High volume of TCP/443 to unknown IP 198.51.100.45. [14:25:30] Charline_L2: Investigation complete. PCAP confirms JA3 hash matches Cobalt Strike default profile. [14:26:00] Charline_L2: STATUS changed to CONFIRMED. [14:26:05] Charline_L2: PRIORITY changed to P1 (Critical). [14:26:10] System: Awaiting next workflow action...
index=firewall src_ip=10.0.5.50 (EHR_DB) | stats count by dest_ip, dest_port | sort - count dest_ip dest_port count state 198.51.100.45 443 450 ESTABLISHED 10.0.1.10 53 12 CLOSED 10.0.5.1 123 4 CLOSED !! WARNING: 198.51.100.45 IS STILL ACTIVE !!
Incident Response Question
Charline is working as an L2 SOC Analyst. One day, an L1 SOC Analyst escalated an incident to her for further investigation and confirmation. Charline, after a thorough investigation, confirmed the incident and assigned it with an initial priority.
What would be her next action according to the SOC workflow?
Tier 3 Analyst Debrief
ExamRange Mentor Insights
What is happening here?
Charline has successfully moved the incident through the Detection & Analysis phase of the NIST Incident Response Lifecycle. She confirmed the threat and set the priority. The immediate next phase is Containment. In enterprise SOC environments governed by Role-Based Access Control (RBAC), security analysts often do not have administrative privileges to alter firewall rules or disable AD accounts. Therefore, the immediate tactical action is to coordinate with the operations team (Network/System Administrators) to execute the containment strategy (e.g., blocking an IP or quarantining a host).
Why B is Correct
Once an L2 analyst confirms a high-priority incident, immediate containment is the highest priority. Contacting the network administrator to "solve the problem" (in this context, executing network containment/blocking) bridges the gap between security analysis and IT operations. You must stop the active threat before doing anything else.
Why Others are Wrong
- Option A: Management is notified for awareness, not for tactical containment.
- Option C: SOC analysts never speak to the media. This is a PR/Legal function.
- Option D: While an IRT ticket might be raised eventually for deep forensics, immediate containment via network admins takes precedence. You don't wait for an IRT queue while data is actively being exfiltrated.
Mini-Lesson: The L2 Containment Handoff
In many organizations, the SOC acts as the "brain" and IT Operations acts as the "hands". This is a crucial concept for the CSA exam:
- L1 (Triage): "I see a weird alert. I'll send it up."
- L2 (Deep Analysis): "I confirm this is a real attack. The priority is High. We need to block IP 198.51.100.45 immediately."
- Network Admin (Containment Execution): Receives the urgent directive from L2 and applies the block rule on the Palo Alto/Cisco firewall.
- IRT / L3 (Remediation & Forensics): Steps in after the bleeding is stopped to reverse-engineer the malware and find root cause.
Want to test your incident triage skills further?
Explore more CSA Simulations