[&] What is the role of the tier 1 SOC analyst in incident detection?
- Monitoring alerts and performing initial triage -- Correct
- Conducting forensic investigations on compromised systems
- Developing detection rules and threat intelligence
- To create an incident response plan

[&] Who is responsible for conducting hypothesis-driven searches for undetected threats within a SOC?
- Incident responders
- Security engineers
- Tier 1 SOC analysts
- Threat hunters -- Correct

[&] What does the containment phase of incident response involve?
- Isolating affected systems to limit the attack's impact -- Correct
- Identifying indicators of compromise
- Monitoring network traffic for unusual activity
- Collecting security logs from various endpoints

[&] How are incident detection and incident response interconnected?
- Incident detection informs the actions taken during incident response -- Correct
- Both processes are identical and interchangeable
- Response eliminates the need for continuous detection efforts
- Response is performed only when detection fails

[&] Which of the following is a key activity in incident response?
- Log collection and aggregation
- Containment and eradication -- Correct
- Real-time monitoring
- Threat hunting

[&] What is the primary focus of incident detection?
- Providing comprehensive threat intelligence reports
- Reviewing completed incident responses
- Investigating and confirming malicious activity
- Identifying and recognizing potential security incidents -- Correct