Security Operations And Management

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

You are configuring a SIEM to integrate with an EDR tool. Which data field is most important for cross-platform correlation when tracking a single user's activity across the network?

What is the primary goal of the 'Eradication' phase in the Incident Response lifecycle?

You are designing a SOC layout to foster collaboration. Which two team members should be seated in close proximity to share real-time intelligence?

Which THREE components are essential to include in a SOC Incident Response plan?

Which TWO factors are most critical when calculating the ROI of a SOC?

Which TWO actions should an analyst take when reviewing an alert that has been flagged as a 'False Positive' in the SIEM?

Which THREE techniques are commonly used by SOC teams to improve alert quality and reduce fatigue?

Which TWO metrics are essential for measuring the efficiency of an incident response team?