312-39 Security Operations And Management — All Questions With Answers

Question 1

A SOC analyst receives an alert from the SIEM indicating a possible data exfiltration attempt. Before escalating, the analyst wants to enrich the alert with threat intelligence to determine if the source IP is malicious. Which type of threat intelligence feed should the analyst consult first to quickly assess the reputation of the IP address?

Accepted Answer

Technical threat intelligence. The analyst requires real-time, actionable information about an IP address to make a triage decision. Technical threat intelligence feeds provide exactly that: specific indicators with reputation data that can be automatically queried. Strategic, operational, and tactical intelligence serve different purposes—long-term planning, attack campaign analysis, and broader IOC sharing—and are not optimized for immediate IP reputation checks during alert handling.

Answer

Tactical threat intelligence

Answer

Strategic threat intelligence

Answer

Operational threat intelligence

Question 2

A SOC analyst is investigating a suspected insider threat. The analyst needs to correlate user activity across multiple systems, including VPN logs, endpoint detection and response (EDR) telemetry, and data loss prevention (DLP) alerts. Which data source should the analyst prioritize to establish a timeline of user actions?

Accepted Answer

EDR telemetry. For insider threat investigations, establishing a detailed timeline of user actions is crucial. EDR telemetry captures endpoint-level activities like process creation, file modifications, and network connections, which directly reflect user behavior. While VPN, DLP, and AD logs provide valuable context, they are narrower in scope. EDR data enables the analyst to see the sequence of events and correlate with other sources effectively.

Answer

Active Directory authentication logs

Answer

VPN logs

Answer

DLP alerts

Question 3

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

Accepted Answer

Security Content Engineer. The Security Content Engineer is the role dedicated to authoring, tuning, and maintaining detection content such as SIEM correlation rules, use cases, and parsers. This role owns the health and efficacy of the detection pipeline, which is exactly what the question describes. Other roles focus on response, governance, or management rather than content lifecycle.

Answer

Incident Responder

Answer

Compliance Officer

Answer

SOC Manager

Question 4

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

Accepted Answer

Correlation Rule Threshold. A correlation rule threshold defines how many matching events within a specified time window must occur before the rule fires an alert. To trigger only when 5 events occur in 60 seconds, you set the threshold count to 5 and the window to 60 seconds in the correlation rule. This is the exact metric that controls the 'how many, how fast' logic of alert generation.

Answer

Event Parser Configuration

Answer

Aggregation Key

Answer

Suppression Window

Question 5

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Accepted Answer

Run host isolation playbook. Host isolation is the fastest way to stop an active threat from spreading laterally or exfiltrating data, and it preserves the endpoint state for later forensics. In a SOAR playbook, isolation is typically the first automated containment action because it is reversible and low-impact compared to network-wide changes.

Answer

Reset all user passwords

Answer

Perform full forensic imaging

Answer

Update the firewall rule base

Question 6

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

Accepted Answer

MSSP. An MSSP (Managed Security Service Provider) is a third-party provider that delivers outsourced security monitoring and management services — such as 24/7 SOC operations, SIEM monitoring, and incident response — while the client organization retains ownership and control of its security posture and policies. This matches the scenario of outsourcing monitoring while retaining internal control.

Answer

Virtual SOC

Answer

Internal SOC

Answer

Hybrid Cloud SOC

Question 7

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Accepted Answer

MTTA. MTTA (Mean Time to Acknowledge) measures the average time between an alert being generated and an analyst acknowledging or being assigned to it, which is exactly the detection-to-assignment interval the SOC wants to optimize. Analyzing MTTA isolates delays in triage routing, queue assignment, or analyst availability. MTTR, by contrast, covers the entire lifecycle through resolution and would mask where the bottleneck actually sits.

Answer

MTTR

Answer

False Positive Rate

Answer

Dwell Time

Question 8

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

Accepted Answer

Level 3. Level 3 (Defined) in the CMMI-based SOC maturity model is characterized by documented, standardized processes that are consistently applied across the organization, but which still rely heavily on manual execution rather than automation. Since the SOC has documented standard processes but lacks consistent automation, it has achieved Level 3. Automation and continuous optimization are hallmarks of the higher levels (Level 4 Quantitative Managed and Level 5 Optimizing), not Level 3.

Answer

Level 5

Answer

Level 2

Answer

Level 1

Question 9

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

Accepted Answer

Tier 1. Tier 1 analysts are the first line of defense in a SOC, responsible for monitoring alerts, performing initial triage, and filtering out false positives. They validate whether an alert is a genuine security incident and escalate only confirmed incidents to Tier 2. This tier requires foundational skills and follows documented procedures to ensure basic incident filtering.

Answer

Tier 3

Answer

SOC Manager

Answer

Tier 2

Question 10

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Accepted Answer

Standardized handover and documentation. Follow-the-Sun relies on handing off active incidents between geographically distributed teams at the end of each shift, so standardized handover procedures and consistent documentation are the critical enablers. Without a uniform template covering incident status, actions taken, and next steps, the incoming team loses context and response stalls. This is a process and people requirement, not a technology purchase.

Answer

Purchasing a new SIEM license

Answer

Moving all logs to the cloud

Answer

Increasing the number of Tier 3 analysts

Question 11

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

Accepted Answer

Updating correlation rules based on new IOCs. A Threat Intelligence analyst's core function is to collect, analyze, and operationalize threat data, which includes translating new indicators of compromise (IOCs) into detection content such as SIEM correlation rules, IDS signatures, and blocklists. Updating correlation rules based on new IOCs directly connects intelligence to detection, closing the loop between research and SOC operations. This is the defining responsibility that distinguishes the role from other SOC functions.

Answer

Hardening server images

Answer

Managing SOC budget

Answer

Writing compliance reports

Question 12

You are configuring a SIEM to integrate with an EDR tool. Which data field is most important for cross-platform correlation when tracking a single user's activity across the network?

Accepted Answer

UPN. The User Principal Name (UPN) is a unique, user-centric identifier (typically formatted like an email address) that remains consistent across platforms, making it the most reliable field for correlating a single user's activity across SIEM and EDR data sources. Unlike IP addresses or device names, the UPN does not change when the user moves between hosts or networks. This makes it the anchor field for identity-based correlation.

Answer

Timestamp

Answer

Device Name

Answer

Source IP

Question 13

What is the primary goal of the 'Eradication' phase in the Incident Response lifecycle?

Accepted Answer

Eliminating the threat. The Eradication phase in the Incident Response lifecycle focuses on removing the threat from the environment. This involves actions such as deleting malware, disabling breached user accounts, and patching vulnerabilities that were exploited. The primary goal is to ensure the threat is completely eliminated so that the system can be safely restored to normal operations.

Answer

Identifying the source

Answer

Blocking traffic

Answer

Restoring backups

Question 14

You are designing a SOC layout to foster collaboration. Which two team members should be seated in close proximity to share real-time intelligence?

Accepted Answer

Threat Hunter and Tier 2/3 Analyst. Threat hunters and Tier 2/3 analysts need frequent communication to pivot between tactical and strategic investigations.

Answer

SOC Manager and IT Support

Answer

Tier 1 Analyst and Compliance Officer

Answer

SOC Manager and HR

Question 15

Which THREE components are essential to include in a SOC Incident Response plan?

Accepted Answer

Defined roles and responsibilities. A is correct because a SOC Incident Response plan must define roles and responsibilities (e.g., incident commander, tier-1/tier-2 analysts, forensics, legal liaison) so each responder knows their authority and tasks during an incident. C is correct because a communication escalation matrix specifies who is notified, in what order, and through which channels (e.g., phone, email, ticketing) as severity increases, ensuring timely stakeholder and management engagement. E is correct because Standard Operating Procedures provide the repeatable, step-by-step playbooks for detection, triage, containment, eradication, and recovery, which are the operational backbone of any IR plan. B is not relevant because physical security building permits are facility-management concerns, not incident response planning components. D is not relevant because a list of office vacation days is an HR/scheduling matter and does not contribute to detecting, responding to, or recovering from security incidents.

Answer

Physical security building permits

Answer

List of office vacation days

Question 16

Which TWO factors are most critical when calculating the ROI of a SOC?

Accepted Answer

Cost of potential data breach incidents. Option A (Cost of potential data breach incidents) is correct because ROI for a SOC is fundamentally about avoided losses — the expected financial impact of breaches (incident response, regulatory fines, legal fees, customer notification, and business disruption) represents the benefit side of the ROI equation, so it must be quantified. Option B (Total cost of security personnel and tools) is correct because ROI requires the full investment side, including SOC analyst salaries, SIEM licensing, EDR, threat intelligence subscriptions, and training, which together form the denominator of the ROI calculation. Options C, D, and E are not relevant financial factors: social media followers, office square footage, and coffee machines do not measure either the cost of the SOC or the losses it prevents, so they cannot meaningfully contribute to an ROI calculation.

Answer

Number of social media followers

Answer

Office space square footage

Answer

Number of coffee machines in the SOC

Question 17

Which TWO actions should an analyst take when reviewing an alert that has been flagged as a 'False Positive' in the SIEM?

Accepted Answer

Document the rationale for closure. Option B is correct because documenting the rationale for closing an alert as a False Positive creates an audit trail and preserves the analyst's reasoning for compliance, reporting, and future investigations. Option D is correct because a confirmed False Positive often reveals that the correlation rule's logic, thresholds, or field mappings are too broad, so tuning the rule reduces future noise and improves detection fidelity. Option A is wrong because simply ignoring an alert without formal closure leaves it in an unresolved state and breaks incident-handling workflow. Option C is wrong because deleting the original event log destroys forensic evidence and violates log retention and integrity requirements. Option E is wrong because a False Positive is a detection-tuning issue, not a licensing capacity problem, so requesting a new SIEM license does not address the root cause.

Answer

Ignore the alert without closure

Answer

Delete the original event log

Answer

Request a new SIEM license

Question 18

Which THREE techniques are commonly used by SOC teams to improve alert quality and reduce fatigue?

Accepted Answer

Alert aggregation. Alert aggregation (A) is correct because grouping related alerts from the same host, user, or campaign into a single incident reduces the number of individual notifications analysts must triage, directly lowering fatigue. Suppression of known-good patterns (C) is correct because whitelisting or suppressing alerts triggered by verified benign activity (e.g., scheduled scans, trusted admin tools) eliminates recurring false positives that waste analyst time. Rule tuning based on historical data (D) is correct because adjusting detection thresholds, correlation logic, and signatures using past alert outcomes (true/false positive rates) raises the signal-to-noise ratio and improves alert fidelity. Removing SOC Tier 1 analysts (B) is not a technique for improving alert quality—it eliminates a triage layer and worsens response capability rather than reducing fatigue. Increasing the volume of log ingestion (E) does not improve alert quality; without better correlation and tuning, more logs typically produce more noise and more fatigue.

Answer

Removing the SOC Tier 1 analysts

Answer

Increasing the volume of log ingestion

Question 19

Which TWO metrics are essential for measuring the efficiency of an incident response team?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) (B) is essential because it directly quantifies how quickly the incident response team detects, acknowledges, and begins mitigating incidents, making it a core efficiency indicator of response speed and effectiveness. Incident volume per analyst (E) is also essential because it measures team throughput and workload distribution, showing how many incidents each analyst handles and helping assess capacity, staffing, and productivity. The other options do not belong: emails sent to stakeholders (A) is a communication activity, not an efficiency metric; average analyst salary (C) is a cost/HR figure unrelated to response performance; and building security badge access logs (D) are physical security data, not incident response efficiency measurements.

Answer

Number of emails sent to stakeholders

Answer

Average salary of analysts

Answer

Building security badge access logs

Question 20

A SOC manager is documenting the team's escalation workflow. During a high-severity incident, the Tier 1 analyst must notify the Tier 2 analyst who then engages the Incident Response lead. The manager wants to formally define the sequence of notifications and responsibilities. Which document should the manager update?

Accepted Answer

Standard Operating Procedure (SOP) for escalation. The manager needs to document a detailed, repeatable operational workflow for escalating incidents. A Standard Operating Procedure (SOP) is the correct type of document for defining such step-by-step processes and assigning specific responsibilities to team members, ensuring consistency and clarity during high-pressure situations.

Answer

Business Continuity Plan (BCP)

Answer

Incident Response Plan (IRP)

Answer

Service Level Agreement (SLA)

312-39 Security Operations And Management — All Questions With Answers

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

You are configuring a SIEM to integrate with an EDR tool. Which data field is most important for cross-platform correlation when tracking a single user's activity across the network?

What is the primary goal of the 'Eradication' phase in the Incident Response lifecycle?

You are designing a SOC layout to foster collaboration. Which two team members should be seated in close proximity to share real-time intelligence?

Which THREE components are essential to include in a SOC Incident Response plan?

Which TWO factors are most critical when calculating the ROI of a SOC?

Which TWO actions should an analyst take when reviewing an alert that has been flagged as a 'False Positive' in the SIEM?

Which THREE techniques are commonly used by SOC teams to improve alert quality and reduce fatigue?

Which TWO metrics are essential for measuring the efficiency of an incident response team?

A SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst confirms the infection and needs to immediately prevent the malware from communicating with its command-and-control (C2) server. Which action should the analyst take first?

A SOC manager is evaluating the team's performance and wants to measure how effectively they are using threat intelligence to prioritize alerts. Which metric best indicates the proportion of high-risk alerts that were correctly identified as true positives?

A SOC manager is reviewing the team's performance and notices that the mean time to detect (MTTD) incidents has increased over the past quarter. Which of the following is the most likely cause for this increase?

You are a SOC analyst investigating a potential data exfiltration incident. The SIEM has generated alerts for unusual outbound traffic to an unknown IP address. To determine if this is a true positive, you need to gather additional evidence. Which TWO actions should you perform? (Choose two.)

During an incident, a SOC analyst needs to preserve volatile evidence from a compromised Linux server before the incident response team arrives. The server is still running and the attacker may still be active. Which action should the analyst take first to capture the most volatile data?

You are a SOC analyst monitoring the SIEM dashboard. An alert triggers for multiple failed login attempts from a single external IP address targeting several user accounts. According to the incident response lifecycle, which phase does this activity represent?

A SOC analyst is tasked with improving the incident response process. The analyst proposes several changes to the current workflow. Which TWO changes would most directly enhance the efficiency of incident handling? (Choose two.)

A SOC analyst is reviewing a security incident that involved a compromised user account. The analyst needs to determine the scope of the compromise by identifying all systems the attacker accessed. Which of the following is the most effective method to achieve this?

A SOC analyst is reviewing a critical alert on a database server that shows a sudden spike in outbound traffic to an unfamiliar IP address. The analyst suspects data exfiltration. According to the incident response lifecycle, which action should the analyst take FIRST?

A SOC analyst is documenting the incident response process for a new playbook. The playbook must specify the correct order of phases according to the NIST SP 800-61 incident response lifecycle. Which phase immediately follows 'Detection and Analysis'?

A SOC manager is evaluating the effectiveness of the team's use of threat intelligence. The manager wants to ensure that threat intelligence is actionable and integrated into daily operations. Which TWO practices are essential for achieving this goal? (Choose two.)

312-39 Security Operations And Management — All Questions With Answers

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

You are configuring a SIEM to integrate with an EDR tool. Which data field is most important for cross-platform correlation when tracking a single user's activity across the network?

What is the primary goal of the 'Eradication' phase in the Incident Response lifecycle?

You are designing a SOC layout to foster collaboration. Which two team members should be seated in close proximity to share real-time intelligence?

Which THREE components are essential to include in a SOC Incident Response plan?

Which TWO factors are most critical when calculating the ROI of a SOC?

Which TWO actions should an analyst take when reviewing an alert that has been flagged as a 'False Positive' in the SIEM?

Which THREE techniques are commonly used by SOC teams to improve alert quality and reduce fatigue?

Which TWO metrics are essential for measuring the efficiency of an incident response team?

A SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst confirms the infection and needs to immediately prevent the malware from communicating with its command-and-control (C2) server. Which action should the analyst take first?

A SOC manager is evaluating the team's performance and wants to measure how effectively they are using threat intelligence to prioritize alerts. Which metric best indicates the proportion of high-risk alerts that were correctly identified as true positives?

A SOC manager is reviewing the team's performance and notices that the mean time to detect (MTTD) incidents has increased over the past quarter. Which of the following is the most likely cause for this increase?

You are a SOC analyst investigating a potential data exfiltration incident. The SIEM has generated alerts for unusual outbound traffic to an unknown IP address. To determine if this is a true positive, you need to gather additional evidence. Which TWO actions should you perform? (Choose two.)

During an incident, a SOC analyst needs to preserve volatile evidence from a compromised Linux server before the incident response team arrives. The server is still running and the attacker may still be active. Which action should the analyst take first to capture the most volatile data?

You are a SOC analyst monitoring the SIEM dashboard. An alert triggers for multiple failed login attempts from a single external IP address targeting several user accounts. According to the incident response lifecycle, which phase does this activity represent?

A SOC analyst is tasked with improving the incident response process. The analyst proposes several changes to the current workflow. Which TWO changes would most directly enhance the efficiency of incident handling? (Choose two.)

A SOC analyst is reviewing a security incident that involved a compromised user account. The analyst needs to determine the scope of the compromise by identifying all systems the attacker accessed. Which of the following is the most effective method to achieve this?

A SOC analyst is reviewing a critical alert on a database server that shows a sudden spike in outbound traffic to an unfamiliar IP address. The analyst suspects data exfiltration. According to the incident response lifecycle, which action should the analyst take FIRST?

A SOC analyst is documenting the incident response process for a new playbook. The playbook must specify the correct order of phases according to the NIST SP 800-61 incident response lifecycle. Which phase immediately follows 'Detection and Analysis'?

A SOC manager is evaluating the effectiveness of the team's use of threat intelligence. The manager wants to ensure that threat intelligence is actionable and integrated into daily operations. Which TWO practices are essential for achieving this goal? (Choose two.)