5.11 Describe the Relationship of SOC Metrics to Scope Analysis (time to Detect, Time to Contain, Time to Respond, Time to Control) 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After a data breach, a SOC team detects the intrusion at 08:00, contains the affected systems by 09:00, and fully restores administrative control and data integrity by 11:00. Which metric best reflects the total time from detection to regaining full control?

   • ATime to control (TTCO)
   • BTime to contain (TTC)
   • CTime to detect (TTD)
   • DTime to respond (TTR)
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What does the SOC metric 'time to detect' (TTD) measure?

   • AThe duration between detection and regaining full control over affected systems or data
   • BThe duration between the occurrence of a security incident and its initial detection by the SOC
   • CThe duration between detection of an incident and the initiation of response actions
   • DThe duration between detection and successfully limiting the spread or impact of an incident
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC manager is comparing two incidents. Incident A had a TTC of 30 minutes and a TTCO of 2 hours. Incident B had a TTC of 2 hours and a TTCO of 3 hours. Which incident demonstrates better containment performance?

   • ABoth incidents had equal containment performance because they both had a TTCO
   • BNeither incident demonstrates good containment because both had TTCO greater than TTC
   • CIncident B, because it had a shorter TTCO
   • DIncident A, because it had a shorter TTC
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC manager is evaluating the effectiveness of the incident response process after a phishing campaign. The manager notices that TTD has been consistently high, but TTR and TTC are within acceptable targets. What does this pattern indicate about the SOC's performance?

   • AContainment is the main issue, and detection is fine.
   • BDetection capabilities are the primary weakness, while response and containment are effective once an alert is raised.
   • CThe SOC is performing well across all phases, and no changes are needed.
   • DResponse actions are too slow, but detection is working well.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which statement best defines SOC metrics?

   • AA set of rules that define how security alerts are escalated to management
   • BQuantitative measures used to evaluate the performance and effectiveness of security operations
   • CQualitative descriptions of security incidents used to prioritize response efforts
   • DA list of security tools and technologies deployed in the SOC environment
   Reveal Solution Discussion Select an answer first