312-39 Security Operations And Management — 10 Questions

Question 1

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

Accepted Answer

Security Content Engineer. The SOC Engineer manages the underlying SIEM infrastructure and rule efficacy.

Answer

Incident Responder

Answer

Compliance Officer

Answer

SOC Manager

Question 2

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

Accepted Answer

Correlation Rule Threshold. A threshold configuration with a count and a time window is the standard approach for rate-limiting alerts.

Answer

Event Parser Configuration

Answer

Aggregation Key

Answer

Suppression Window

Question 3

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Accepted Answer

Run host isolation playbook. Isolating the affected asset prevents lateral movement before moving to eradication.

Answer

Reset all user passwords

Answer

Perform full forensic imaging

Answer

Update the firewall rule base

Question 4

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

Accepted Answer

MSSP. Managed Security Service Provider (MSSP) models allow outsourcing while maintaining operational oversight.

Answer

Virtual SOC

Answer

Internal SOC

Answer

Hybrid Cloud SOC

Question 5

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Accepted Answer

MTTA. Mean Time to Acknowledge (MTTA) specifically measures the time from alert generation to human intervention.

Answer

MTTR

Answer

False Positive Rate

Answer

Dwell Time

Question 6

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

Accepted Answer

Level 3. Level 3 (Defined) indicates processes are established and documented, but not yet optimized.

Answer

Level 5

Answer

Level 2

Answer

Level 1

Question 7

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

Accepted Answer

Tier 1. Tier 1 analysts perform the initial monitoring, triage, and basic categorization of alerts.

Answer

Tier 3

Answer

SOC Manager

Answer

Tier 2

Question 8

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Accepted Answer

Standardized handover and documentation. Standardization of playbooks and handoff procedures ensures continuity across different time zones.

Answer

Purchasing a new SIEM license

Answer

Moving all logs to the cloud

Answer

Increasing the number of Tier 3 analysts

Question 9

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

Accepted Answer

Updating correlation rules based on new IOCs. Integrating external threat feeds to update correlation rules is a core function of threat intelligence within operations.

Answer

Hardening server images

Answer

Managing SOC budget

Answer

Writing compliance reports

Question 10

You are configuring a SIEM to integrate with an EDR tool. Which data field is most important for cross-platform correlation when tracking a single user's activity across the network?

Accepted Answer

UPN. The UPN (User Principal Name) or SID provides the unique identifier needed for correlating activity across multiple disparate systems.

Answer

Timestamp

Answer

Device Name

Answer

Source IP