5.11 Describe the Relationship of SOC Metrics to Scope Analysis (time to Detect, Time to Contain, Time to Respond, Time to Control) 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC manager wants to evaluate how well the team detects incidents that occur outside of normal business hours. The team's scope analysis for this evaluation includes only incidents that occur between 18:00 and 06:00. Which metric should the manager focus on to assess this specific aspect of performance?

   • ATime to control (TTCO)
   • BTime to contain (TTC)
   • CTime to detect (TTD)
   • DTime to respond (TTR)
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC manager is reviewing the following incident metrics for the past quarter: - Average TTD: 6 hours - Average TTR: 15 minutes - Average TTC: 2 hours - Average TTCO: 8 hours The manager notices that TTD is high, but TTR is very low. The manager also sees that TTCO is significantly higher than TTC. The SOC has a limited budget and must decide where to focus improvements. Which conclusion is most justified?

   • ADetection is the primary bottleneck; improving alerting and monitoring would likely reduce TTD and also reduce TTCO.
   • BResponse is the primary bottleneck; the team should focus on faster playbook execution.
   • CContainment is the primary bottleneck; the team should focus on isolation procedures.
   • DThe SOC is performing well; no improvements are needed.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An incident response team detected a breach at 16:00. They contained the affected systems by 17:00, but it took until 20:00 to regain full administrative control and ensure the attacker no longer had access. The SOC manager wants to report the time to control (TTCO). What is the TTCO?

   • A16:00 to 20:00 — 4 hours
   • B16:00 to 17:00 — 1 hour
   • C17:00 to 20:00 — 3 hours
   • DFrom the initial compromise time to 20:00 — unknown
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC analyst is assigned to investigate a potential data breach. The analyst is told to focus only on the systems that store customer payment data and to determine whether any unauthorized access occurred. What is the analyst performing?

   • ATime to detect calculation — measuring how long the breach went unnoticed
   • BContainment strategy — isolating affected systems
   • CThreat hunting — proactively searching for unknown threats
   • DScope analysis — defining the boundaries and objectives of the investigation
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which activity is a key part of scope analysis in incident response?

   • ADefining which systems and data are included in the investigation
   • BRestoring affected systems from backups
   • CConducting a post-incident review meeting
   • DDeploying additional security tools to the network
   Reveal Solution Discussion Select an answer first