SOC & Detection Questions

Summary

'How would you triage this alert?' or 'what's the MITRE ATT&CK framework?' — testing Phase 7's SOC operations and detection engineering knowledge against a practical scenario.

• 1Review Phase 7 and practice triaging a sample alert scenario out loud.
• 2Prepare to explain how you'd distinguish a false positive from a real threat.
• 3Practice referencing MITRE ATT&CK to describe a hypothetical attack's stages.