312-39 › Incident Detection And Triage
This domain covers detecting and triaging security incidents in a SOC using SIEM tooling, primarily ArcSight ESM. Questions test correlation rule troubleshooting, alert triage data gathering, prioritization by business impact, and time-based alert configuration. Expect scenario-based items requiring you to reason about why rules fail, what evidence matters first, and where settings live.
312-39 Incident Detection And Triage — All 80 Questions
Every question in this domain with answers and detailed explanations.