CSA (312-39) SOC Simulation Lab

Master the Incident Response Lifecycle. In this lab, you will identify the precise operational phase a SOC analyst is performing when correlating alerts across multiple security tools.

Scenario Context

You are a Tier 3 analyst overseeing the SOC floor. An alert titled "Suspicious PowerShell Execution via Office App" triggered on the endpoint WKS-MARCUS-01. The ticket has landed in the queue, and Jennifer, an L1 analyst, immediately takes ownership.

She is not yet declaring a formal security incident. Instead, she is rapidly pivoting between Splunk, CrowdStrike (EDR), and Proofpoint (Email Gateway) to answer one critical question: "Is this a true positive compromise, or did Marcus just run a legitimate, poorly-written corporate macro?"

Security Environment

You observe Jennifer compiling the following artifacts into her working notes:

[SIEM ALERT] Severity: HIGH | Rule: Suspicious PS Encoded Command
Endpoint: WKS-MARCUS-01 | User: CORP\marcus.t

# EDR Telemetry - Process Tree Validation
OUTLOOK.EXE -> WINWORD.EXE (Invoice_738.docm) -> POWERSHELL.EXE
Cmdline: powershell.exe -w hidden -enc JABzAD0ATgBlAHcALQBPAGIAagBl...

# Email Gateway Validation
Time: 08:14:22Z | Sender: billing@external-vendor.com
Subject: Urgent Invoice | Attachment: Invoice_738.docm | Verdict: Delivered (Clean)

# Firewall Proxy Logs Validation
Source: 192.168.10.45 | Dest: 104.21.34.4 (Malicious C2) | Action: ALLOWED

Jennifer, a SOC analyst, initiates an investigation after receiving an alert about potential unauthorized activity on Marcus's workstation. She starts by retrieving EDR logs from the endpoint, analyzing network traffic patterns in the Security Information and Event Management (SIEM) system, and inspecting email gateway logs for signs of malicious attachments. Her objective is to determine whether this alert represents a legitimate security incident. In which phase of the Incident Response process is Jennifer currently operating?

Hint: Focus on her stated objective: "determine whether this alert represents a legitimate security incident." She is evaluating the severity and reality of the threat, not performing deep-dive chain-of-custody preservation.

Expert Insight: Senior SOC Analyst Debrief

What is happening here?

SOCs receive thousands of alerts daily. When an alert fires, it is not immediately treated as a full-blown incident. The L1/L2 analyst must perform rapid correlation across multiple data sources (Endpoint, Network, Email) to validate if the alert is a True Positive (actual threat) or a False Positive (benign administrative behavior). In this scenario, Jennifer is connecting the dots: an email arrived, a macro was executed, a hidden PowerShell script ran, and it successfully connected to a C2 server. She has confirmed a true compromise.

Why option A is correct

Incident Triage is the initial step of evaluating an event or alert. The primary goals of triage are verification (is this real?), categorization (what type of attack is this?), and prioritization (how critical is this?). Jennifer gathering EDR, SIEM, and Email logs to determine if the alert is legitimate fits the exact definition of Triage.

Why the other options are wrong

Evidence Gathering and Forensic Analysis (B) happens after an incident is confirmed and declared. It involves deep, methodical artifact collection (memory dumps, full disk imaging) adhering to the chain of custody. Incident Recording and Assignment (C) happened the moment the SIEM generated a ticket and assigned it to Jennifer. Notification (D) will happen next; now that she has triaged and confirmed the threat, she will notify the Incident Response team or SOC management.

Real-world SOC Application

In a real SOC, you typically have an SLA (Service Level Agreement) of 15 to 30 minutes to complete Triage. You do not have time to do "Forensic Analysis" on every alert. You use the "Golden Triangle" of visibility: 1) Did it arrive? (Email/Web logs), 2) Did it execute? (EDR/Process logs), 3) Did it communicate? (Network/Firewall logs). Jennifer successfully completed the triangle.

Mini-Lesson: The Output of Triage

The Triage phase must always end with a definitive binary decision: Escalate or Close.

Close (False Positive): "This is the IT team running a legitimate vulnerability scanner. Closed as Benign."
Escalate (True Positive): "Confirmed malicious macro execution leading to C2 beaconing. Upgrading from 'Alert' to 'Incident'. Initiating endpoint containment and escalating to Tier 3 / Incident Commander."

Ready to sharpen your SOC skills further?

Explore more realistic L1/L2/L3 scenarios and Incident Response labs.

Explore CSA Simulations