200-201 Security Policies and Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Communicate with the media

  Why it's wrong here

  Media communication belongs to communications or PR staff, not a Tier 1 analyst triaging a malware alert. It is tempting because incident response does include external messaging, but that is the correct choice only for a designated spokesperson handling public disclosure, not first-line alert validation.

• ✗

  Develop detection signatures

  Why it's wrong here

  Signature development is detection engineering work, not Tier 1 triage of a live malware alert. It is tempting because SOC staff do create detections, but that is the correct choice only for a detection engineer role, whereas Tier 1 validates the alert and escalates confirmed incidents.

• ✗

  Conduct advanced malware analysis

  Why it's wrong here

  Advanced malware analysis is a Tier 2 or Tier 3 reverse-engineering task, beyond Tier 1 scope. It is tempting because the alert concerns malware, but that is the correct choice only for a senior analyst performing sandbox or disassembly work, not initial triage and escalation.

• ✓

  Perform initial triage and basic investigation

  Why this is correct

  Tier 1 handles alert monitoring and initial triage, validating whether an alert is a true positive and gathering basic evidence before escalation. Deep malware reverse engineering and enterprise-wide containment decisions belong to Tier 2 or Tier 3, so basic investigation is the correct scope.

Go deeper

Related to this question