Câu 8: 312-39V2: Certified SOC Analyst (CSA) v2

Jennifer, a SOC analyst, initiates an investigation after receiving an alert about potential unauthorized activity on Marcus's workstation. She starts by retrieving EDR logs from the endpoint, analyzing network traffic patterns in the Security Information and Event Management (SIEM) system, and inspecting email gateway logs for signs of malicious attachments. Her objective is to determine whether this alert represents a legitimate security incident. In which phase of the Incident Response process is Jennifer currently operating?

1. A. Notification
2. B. Incident Triage
3. C. Evidence Gathering and Forensic Analysis — đáp án hiện tại
4. D. Incident Recording and Assignment