CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Number of firewall rules

  Why it's wrong here

  Firewall rule count reflects network segmentation policy and configuration complexity, not operational effectiveness. A SOC's success is measured by how quickly and accurately it detects, contains, and eradicates threats; adding or removing rules does not quantify detection latency, response quality, or business impact reduction. An overly large rule base can even degrade performance and increase misconfiguration risk, making it a compliance or hygiene indicator rather than a performance metric.

• ✗

  Number of employees in the SOC

  Why it's wrong here

  SOC headcount is a resourcing or staffing metric, not a measure of operational effectiveness. A larger team does not automatically translate to shorter detection or response times; effectiveness depends on process maturity, tooling, training, and workflow integration. Conversely, a small, well-orchestrated team can outperform a larger one, so raw headcount fails to capture the quality or speed of incident handling.

• ✓

  Mean Time to Respond (MTTR)

  Why this is correct

  Mean Time to Respond (MTTR) quantifies how quickly a SOC team takes action to contain an incident after detection. It typically measures the interval between alert triage and the first mitigation step (e.g., isolating a host, blocking a C2 domain), directly reflecting the team's readiness and playbook efficiency. Lower MTTR indicates faster containment, which reduces the attacker's dwell time and prevents lateral movement.

• ✓

  Mean Time to Remediate (MTTRem)

  Why this is correct

  Mean Time to Remediate (MTTRem) tracks the total elapsed time from incident detection (or start of response) until the threat is fully eradicated and systems are restored to normal operation. It encompasses the entire incident lifecycle, including root-cause removal, patch deployment, and verification of recovery, making it a broader measure than MTTR. A lower MTTRem signals that the organization not only contains but also permanently resolves threats, minimizing recurrence and lingering vulnerability.

• ✓

  Mean Time to Detect (MTTD)

  Why this is correct

  Mean Time to Detect (MTTD) measures the average duration between when an attack or compromise first occurs and when the SOC becomes aware of it through an alert or other indicator. It directly captures the visibility and monitoring coverage of the SOC; for example, a high MTTD implies gaps in log collection, correlation rules, or endpoint detection. Reducing MTTD is critical because longer detection times give attackers more opportunity to move laterally and exfiltrate data.

Go deeper

Related to this question