[&] Which activity includes determining the origin of a security event during an investigation?
- Root cause analysis -- Correct
- Escalation process
- Threat hunting
- Severity assessment

[&] What is the role of a Tier 1 analyst in the event triage process?
- Conducting in-depth forensic investigations on compromised systems
- Monitoring alerts and performing initial analysis -- Correct
- Developing automated response playbooks for incident handling
- Creating detection rules to identify advanced threats

[&] What is the primary goal of event triage in a security operations center?
- To perform a detailed forensic analysis
- Prioritizing and categorizing events to determine their severity and relevance -- Correct
- Collecting event logs to enhance detection capabilities
- Correlating events across systems to detect potential threats

[&] In the context of event triage, what does filtering false positives involve?
- Correlating alerts across multiple data sources
- Prioritizing high-severity alerts for immediate investigation
-  Identifying benign events incorrectly flagged as malicious -- Correct
- Automating detection processes to improve efficiency

[&] During an investigation, what is the purpose of threat hunting?
- Developing detection signatures for future use
- Monitoring traffic logs for routine performance analysis
- Identifying patterns in alerts to improve detection accuracy
- Proactively searching for hidden threats that evade existing detection mechanisms -- Correct

[&] What does the term 'severity assessment' mean in the event triage process?
- Identifying the root cause of a detected incident
- Filtering out false positives from collected alerts
- Assessing risk based on event impact -- Correct
- Automating alert generation to reduce workload