Security Operations And Management

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

You are configuring a SIEM to integrate with an EDR tool. Which data field is most important for cross-platform correlation when tracking a single user's activity across the network?

What is the primary goal of the 'Eradication' phase in the Incident Response lifecycle?

You are designing a SOC layout to foster collaboration. Which two team members should be seated in close proximity to share real-time intelligence?

Which THREE components are essential to include in a SOC Incident Response plan?

Which TWO factors are most critical when calculating the ROI of a SOC?

Which TWO actions should an analyst take when reviewing an alert that has been flagged as a 'False Positive' in the SIEM?

Which THREE techniques are commonly used by SOC teams to improve alert quality and reduce fatigue?

Which TWO metrics are essential for measuring the efficiency of an incident response team?

A SOC manager is documenting the team's escalation workflow. During a high-severity incident, the Tier 1 analyst must notify the Tier 2 analyst who then engages the Incident Response lead. The manager wants to formally define the sequence of notifications and responsibilities. Which document should the manager update?

A SOC analyst is investigating a suspected data exfiltration incident. The SIEM shows a large outbound data transfer from an internal server to an unknown external IP address. To determine if this is a true positive, the analyst needs to correlate user activity with the network event. Which data source would provide the MOST direct evidence of the user or process responsible for the transfer?

A SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst confirms the infection and needs to immediately prevent the malware from communicating with its command-and-control (C2) server. Which action should the analyst take first?

A SOC manager is evaluating the team's performance and wants to measure how effectively they are using threat intelligence to prioritize alerts. Which metric best indicates the proportion of high-risk alerts that were correctly identified as true positives?

A SOC manager at a financial services company is preparing an audit defense for a recent data breach. The auditor asks for documented proof of how the SOC's daily operational activities align with the organization's overall business objectives and risk appetite. Which component of a SOC governance framework should the manager present to satisfy this request?

A SOC analyst receives a high-severity alert indicating that a workstation is communicating with a known command-and-control domain. Before escalating to the incident response team, the analyst wants to determine whether the alert represents a true positive and gather additional context. Which action best supports this triage decision while preserving forensic evidence?

You are the SOC manager at a financial institution. During a monthly review, you notice that the mean time to detect (MTTD) security incidents has increased from 15 minutes to 3 hours over the past quarter. After investigation, you find that analysts are manually correlating alerts from the SIEM with threat intelligence feeds, which is time-consuming. Which action should you take FIRST to reduce MTTD?

A SOC manager is reviewing the team's performance and notices that the mean time to detect (MTTD) incidents has increased over the past quarter. Which of the following is the most likely cause for this increase?

A SOC is implementing a new use case to detect credential dumping on Windows endpoints. The detection engineering team wants to combine multiple telemetry sources to reduce false positives and improve coverage. Which two data sources should be prioritized to reliably detect credential dumping activity? (Choose two.)

You are a SOC analyst investigating a potential data exfiltration incident. The SIEM has generated alerts for unusual outbound traffic to an unknown IP address. To determine if this is a true positive, you need to gather additional evidence. Which TWO actions should you perform? (Choose two.)

During an incident, a SOC analyst needs to preserve volatile evidence from a compromised Linux server before the incident response team arrives. The server is still running and the attacker may still be active. Which action should the analyst take first to capture the most volatile data?

You are a SOC analyst monitoring the SIEM dashboard. An alert triggers for multiple failed login attempts from a single external IP address targeting several user accounts. According to the incident response lifecycle, which phase does this activity represent?

A SOC analyst is reviewing a SIEM alert that fired on a suspicious PowerShell execution. The command line includes an encoded parameter and a download cradle. The analyst confirms the endpoint is a developer workstation used for legitimate automation. Which action best balances security and business continuity while still validating the alert?

A SOC analyst is tasked with improving the incident response process. The analyst proposes several changes to the current workflow. Which TWO changes would most directly enhance the efficiency of incident handling? (Choose two.)

A SOC analyst is reviewing a security incident that involved a compromised user account. The analyst needs to determine the scope of the compromise by identifying all systems the attacker accessed. Which of the following is the most effective method to achieve this?

A SOC analyst is reviewing a critical alert on a database server that shows a sudden spike in outbound traffic to an unfamiliar IP address. The analyst suspects data exfiltration. According to the incident response lifecycle, which action should the analyst take FIRST?

A SOC analyst is investigating a suspected compromised user account. The analyst observes that the account was used to access a critical file server at 3:00 AM, outside of normal business hours, from an IP address geolocated in a foreign country. The account owner is currently on vacation in that country. Which factor is MOST important to consider when determining if this is a true positive?

A SOC analyst is documenting the incident response process for a new playbook. The playbook must specify the correct order of phases according to the NIST SP 800-61 incident response lifecycle. Which phase immediately follows 'Detection and Analysis'?

A SOC manager is evaluating the effectiveness of the team's use of threat intelligence. The manager wants to ensure that threat intelligence is actionable and integrated into daily operations. Which TWO practices are essential for achieving this goal? (Choose two.)