Security Operations

Which component in the MITRE ATT&CK framework should be mapped to an SOC alerting rule to ensure the alert covers a specific adversary objective?

In Splunk Enterprise Security, which dashboard should the SOC manager review to evaluate the effectiveness of the current correlation searches and the volume of notable events?

Which THREE pieces of information should be included in an 'Incident Notification' for executive stakeholders?

A security analyst is troubleshooting a failed connection to an internal application that is protected by Zscaler Private Access (ZPA). Which tool should the analyst use to verify if the policy is blocking the request?

Which TWO data sources are most critical for detecting lateral movement within a corporate network?

Which THREE types of data should be ingested by a SIEM to improve its threat detection capabilities?

An organization uses Microsoft Sentinel. To ensure that an automated incident response playbook only triggers when a high-severity alert originates from a specific production subnet, where should the condition be defined?

When managing a FortiGate firewall, which feature allows the SOC to dynamically update network objects based on external threat feeds?

In the context of the Google Cloud Security Command Center (SCC), which feature provides a prioritized list of findings based on the criticality of the impacted asset?

Which SOC process ensures that all security tools are configured to log at the same time standard to prevent confusion during timeline analysis?

When configuring CrowdStrike Falcon to isolate a host during an active incident, what is the prerequisite requirement for the agent's communication state?

Which THREE actions should be taken when performing an incident post-mortem according to industry best practices?

Which TWO of the following are primary components of an effective Incident Response (IR) program?

In Okta, to restrict administrative access to a specific geographic region during an active session, which policy should be modified?

In Rapid7 InsightVM, what is the best way to categorize assets into groups based on their business function for targeted vulnerability reporting?

Which THREE technical controls are effective for limiting the impact of lateral movement?

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

An organization is investigating a potential lateral movement incident in AWS. Which CloudTrail event field provides the most reliable indicator of the source IP address for an API call performed by an IAM role?

When configuring a Cisco ASA firewall to log deny events to a remote Syslog server, what is the minimum logging level required to ensure that denied packets are captured?

Which THREE activities are included in the 'Preparation' phase of the IR life cycle?

When configuring a Qualys scanner to perform authenticated scans on Windows, what is the 'Windows Authentication Record' primarily used for?

Which TWO communication channels are typically used for emergency incident coordination within a SOC?

During an incident, which document is used by the SOC to record evidence, timestamps, and actions taken to ensure admissibility in a legal proceeding?

When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?

In an incident response plan, which metric is most useful for measuring the 'dwell time' of a threat actor?

Which phase of the NIST Incident Response Life Cycle involves activities like system sanitization and validation of system integrity?

Which THREE factors are required to calculate the 'Risk' of a vulnerability for reporting purposes?

In VMware Carbon Black Cloud, which feature should be enabled to block unauthorized scripts while allowing signed binaries from trusted software vendors?

In Tenable.io, when prioritizing vulnerability remediation, which metric provides the best insight into the likelihood of a vulnerability being exploited in the wild?

Which document describes the specific steps an analyst should take when a 'Phishing' alert is triggered in the SIEM?

When implementing FIM (File Integrity Monitoring) in Tripwire Enterprise, what is the specific purpose of a 'Promotion' action?

When analyzing network traffic in Wireshark for potential exfiltration, what specific filter allows you to isolate TCP traffic where the payload size exceeds 10MB?

Which SOC metric is most appropriate to present to executive leadership to demonstrate the business value of security investments?

Which TWO metrics are essential for evaluating the performance of a SOC team in identifying and containing threats?

Which document is considered the primary 'source of truth' for defining the SOC's roles, responsibilities, and communication paths during a major security incident?

A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?