5.11 Describe the Relationship of SOC Metrics to Scope Analysis (time to Detect, Time to Contain, Time to Respond, Time to Control) 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security incident was detected at 09:00. The SOC team contained the affected systems by 10:00, but it took until 14:00 to regain full administrative control over all affected servers and verify data integrity. The SOC manager asks for the time to control (TTCO). What is the TTCO?

   • A10:00 to 14:00 — 4 hours
   • BFrom the initial compromise time to 14:00 — unknown
   • C09:00 to 14:00 — 5 hours
   • D09:00 to 10:00 — 1 hour
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   During a ransomware incident, the SOC detected the attack at 10:00. The team isolated the infected systems at 10:30, achieving containment. However, the team did not regain full administrative control over the affected servers until 18:00 because the ransomware had encrypted critical files and the decryption process was slow. The SOC manager must report the metrics. Which statement is accurate?

   • ATTC and TTCO are both 8 hours because the incident was not fully resolved until 18:00.
   • BTTC is 30 minutes, but TTCO is 8 hours, indicating that containment was quick but regaining control took much longer.
   • CTTC and TTCO are both 30 minutes because containment was achieved quickly.
   • DTTC is 8 hours, and TTCO is 30 minutes.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which scenario best illustrates a successful containment action?

   • AThe SOC identifies the root cause of a breach and documents it
   • BThe SOC isolates an infected workstation to prevent the malware from spreading to other systems
   • CThe SOC detects a suspicious file and begins analyzing it
   • DThe SOC restores affected systems from backups
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SOC team is handling an incident where an attacker is moving laterally across the network. The team detected the initial compromise at 09:00, but it took until 12:00 to isolate all affected systems and stop the lateral movement. The SOC manager wants to evaluate how quickly the team was able to limit the spread of the incident. Which metric should be reported?

   • ATime to contain (TTC) — 3 hours
   • BTime to control (TTCO) — unknown
   • CTime to respond (TTR) — unknown
   • DTime to detect (TTD) — unknown
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC manager is comparing two incidents. Incident A had a TTD of 2 hours and a TTR of 30 minutes. Incident B had a TTD of 30 minutes and a TTR of 2 hours. Both incidents had the same TTC. What can be concluded about the SOC's performance?

   • AIncident A was handled better overall because TTR is more important than TTD.
   • BIncident B was handled better overall because TTD is more important than TTR.
   • CIncident A had slower detection but faster response initiation; Incident B had faster detection but slower response initiation.
   • DThe SOC's performance was identical for both incidents because TTC was the same.
   Reveal Solution Discussion Select an answer first