[&] What method is recommended to ensure the integrity and reliability of backups?
- Compressing backups to minimize storage requirements
- Storing backups securely and regularly testing them for integrity
- Storing backups exclusively on local storage devices
- Automating backup processes without periodic reviews

[&] Why is it important to conduct a post-mortem review after an incident response?
- To analyze what detection mechanisms worked and identify areas for improvement
- To collect malware samples for signature development
- To establish automated detection and response protocols
- To generate compliance reports for regulatory requirements

[&] What is the role of a SIEM tool in incident detection within a SOC?
- It manages user access and authentication
- It focuses solely on endpoint protection
- It performs automated malware removal
- It correlates security alerts and identifies potential threats

[&] In the context of SOC workflows, what is the primary responsibility of a Tier 1 analyst during an incident?
- Implementing security patches and mitigations
- Validate alerts and determine the scope of the attack
- Conducting in-depth forensic investigations on compromised systems
- Isolating infected/affected systems

[&] How can enhancing user training improve the incident response process?
- By enabling automated isolation of systems
- By increasing awareness of phishing tactics
- By reducing the time to restore backups
- By refining SIEM correlation rules