In this scenario, you will apply standard risk management formulas to triage and prioritize competing SIEM alerts. You will learn how Likelihood, Impact, and Asset Value combine to determine the true severity of a potential incident.
Scenario Context
You are working alongside Lisa Carter, a SOC analyst at a major financial services firm. The SOC is currently experiencing an alert spike, with multiple SIEM notables firing simultaneously. You cannot investigate everything at once.
To prioritize response efforts, Lisa relies on the organization's SOAR platform, which enriches incoming alerts with threat intelligence (Likelihood), business impact analysis (Impact), and CMDB data (Asset Value) to calculate a final Risk Score.
Security Environment
The SOAR platform displays the current triage queue waiting for Lisa's assignment. Notice how the three variables map to the alerts:
INC-9901 | Title: Suspected Ransomware Activity (CrowdStrike)
↳ Threat Intel: Campaign: FIN7 | Likelihood: HIGH (Active IOCs confirmed)
↳ CMDB Data: Asset: DB-PROD-CUST-01 | Value: HIGH (PCI/Customer Data)
↳ BIA Matrix: Business Impact: HIGH (Tier 1 Core Banking App)
↳ Status: Pending Risk Calculation
INC-9902 | Title: Brute Force Attempt (AWS WAF)
↳ Threat Intel: Source: Botnet IP | Likelihood: LOW (WAF is actively blocking)
↳ CMDB Data: Asset: DEV-TEST-WEB | Value: LOW (Sanitized test data)
↳ BIA Matrix: Business Impact: LOW (Non-critical sandbox)
↳ Status: Pending Risk Calculation
Question
Lisa Carter, a SOC analyst at a financial services firm, is performing a risk assessment following a series of suspicious alerts detected by the SIEM (Security Information and Event Management) system. Her task is to evaluate the risk of a potential data breach prioritizing incident response efforts. She assesses three key factors: the likelihood of an attack succeeding based on current threat intelligence, the impact on critical business operations if the breach occurs, and the value of the assets targeted (e.g., customer data, financial systems). Using the standard risk assessment formula, which of the following scenarios represents the highest risk to the organization?
SOC Hint: In quantitative risk assessments, Risk is calculated as a product of its factors (Risk = Likelihood × Impact × Asset Value). Which combination mathematically yields the largest result?
Expert Insight
1. What is Happening
SOC analysts are constantly bombarded with alerts (alert fatigue). To maintain operational effectiveness, analysts cannot treat every alert equally. Lisa is utilizing a risk-based triage methodology to determine which incident requires an immediate, "drop-everything" response (SEV-1) versus which can wait in the queue.
2. Why the Correct Answer is Correct
C is correct. Risk is generally defined as the potential for loss. In the standard formula (Risk = Likelihood × Impact × Asset Value), maximizing all three variables logically produces the highest overall risk score. An incident where an attacker is highly likely to succeed, against a high-value target, resulting in high business disruption, is the worst-case scenario for any organization.
3. Why Other Options are Wrong
If any single factor is "Low," it acts as a multiplier that brings the total risk score down:
A (Low L, Low I, High A): An attacker targeting your main database but using an exploit that was patched 5 years ago (Low Likelihood) and blocked by the firewall (Low Impact). Risk is low.
B (High L, Low I, High A): An attacker actively hammering a high-value server, but the network architecture prevents any lateral movement or data exfiltration (Low Impact). Risk is medium.
D (Low L, High I, Low A): A theoretical zero-day exploit (High Impact) aimed at a forgotten developer sandbox (Low Asset Value) that isn't connected to the internet (Low Likelihood). Risk is low.
4. Real-World SOC Application
In mature SOCs, this calculation is automated. SIEM platforms (like Splunk ES) and SOAR tools (like Cortex XSOAR or ServiceNow SecOps) query the Configuration Management Database (CMDB) to pull the Asset Value. They query Threat Intel feeds (like Recorded Future) to assess Likelihood. The resulting Risk Score automatically sets the SLA (Service Level Agreement) for the analyst—e.g., a High/High/High score forces a 15-minute response window.
MINI LESSON: Quantitative Triage Scoring
When you need to quickly prioritize incidents manually, apply the 3x3x3 matrix by assigning numerical values:
By mapping qualitative labels to quantitative scores, SOC analysts can quickly justify their incident escalation decisions to management during a crisis.
Sharpen your SIEM analysis and prepare for the CSA exam.