[&] During which phase does a SOC tier 1 analyst decide to dismiss, contain, or escalate an alert?
- Decision phase
- Severity scoring
- Context enrichment
- Initial classification

[&] Which phase in the triage process involves applying a formula like Impact x Likelihood to categorize alerts?
- Deduplication
- Escalation
- Severity scoring
- Context enrichment

[&] What is the primary purpose of triage in cybersecurity operations?
- To rapidly filter security signals to focus on real threats
- To increase the workload of incident responders
- To visualize data for better insights
- To categorize logs into different storage systems

[&] How does the 'Initial Classification' phase in the triage process benefit the incident responder?
- It provides immediate context about the alert type and involved assets
- It escalates minor issues to the Tier 2 team
- It removes duplicates from the alert queue
- It guarantees alerts are addressed sequentially