5.11 Describe the Relationship of SOC Metrics to Scope Analysis (time to Detect, Time to Contain, Time to Respond, Time to Control) 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is it important to consider SOC metrics in the context of scope analysis?

   • ABecause metrics help define the objectives of an investigation
   • BBecause metrics provide a way to measure the effectiveness of incident response within the defined boundaries of an investigation
   • CBecause metrics are used to identify the attackers responsible for an incident
   • DBecause metrics are used to determine the financial impact of an incident
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC team is reviewing a security incident. The initial compromise occurred at 08:00, but the SOC did not detect it until 11:00. The response team began containment at 11:30. The SOC manager wants to improve the team's ability to reduce the time between compromise and detection. Which metric should the manager focus on improving?

   • ATime to contain (TTC)
   • BTime to respond (TTR)
   • CTime to control (TTCO)
   • DTime to detect (TTD)
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC analyst is investigating a potential insider threat. The analyst is asked to determine whether any employees accessed sensitive files outside of business hours. The analyst limits the investigation to the file server logs and the authentication logs for the last 30 days. What is the analyst doing?

   • APerforming scope analysis by defining the systems and time frame to investigate
   • BMeasuring the time to respond to the insider threat
   • CContaining the insider threat by restricting access
   • DCalculating the time to detect for the insider threat
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After detecting a malware outbreak at 13:00, the SOC team immediately began investigating. However, due to a lack of clear procedures, the team did not start containment actions until 15:00. The SOC manager wants to reduce the delay between detection and the start of response actions. Which metric should be tracked and improved?

   • ATime to detect (TTD)
   • BTime to contain (TTC)
   • CTime to respond (TTR)
   • DTime to control (TTCO)
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which scenario best illustrates a long time to detect (TTD)?

   • AThe SOC responds to an alert within 30 minutes of receiving it
   • BThe SOC identifies a malware infection and contains it within an hour
   • CAn attacker compromises a server, but the SOC does not identify the breach until three weeks later
   • DThe SOC detects an intrusion within minutes and immediately begins containment
   Reveal Solution Discussion Select an answer first