Server+ PBQ Lab: SOC Investigation and Incident Response War Room

In this Security+ PBQ lab, the learner steps into a SOC war-room investigation after several noisy alerts fire across endpoint, identity, email, firewall, and DLP systems. The challenge is to correlate evidence, identify the true compromise chain, preserve useful forensic data, contain the correct host and user session, and avoid broad or destructive response actions that make the incident harder to prove. This lab tests incident response, log correlation, threat hunting, endpoint evidence, identity containment, and scoped remediation under realistic alert noise.