A SOC analyst receives an alert from the SIEM about a suspicious outbound connection from a finance workstation to an unknown IP address. The alert lacks context about whether this is a known threat. According to standard SOC processes, what should the analyst do FIRST?

Escalate the alert to the incident response team immediately

Perform initial triage by checking the threat intelligence feed and the asset's historical behavior

Close the alert as a false positive because the IP is not on the blocklist

Isolate the workstation from the network to contain the potential threat

During a major security incident, a SOC analyst discovers that the incident response plan is outdated and does not cover the type of attack that occurred. According to SOC best practices, what should the analyst do?

Escalate the issue to the SOC manager and recommend updating the incident response plan

Wait for the incident to end before addressing the plan gap

Improvise a response based on their own judgment and experience

Ignore the plan and continue with standard monitoring duties

Which tool is commonly used in a SOC to automate repetitive tasks and orchestrate response actions?

Endpoint Detection and Response (EDR)

SOAR (Security Orchestration, Automation, and Response)

EC-CouncilCertified SOC Analyst

Domain 1Objective 1

Security Operations Center (SOC) Fundamentals CSA Practice Questions (Page 2)

Part of the Security Operations and Management domain, which makes up ~12% of our current practice bank.

45questions here

9free pages

8concepts

Questions 6–10

6expert · hard
A company is deciding between a fully in-house SOC and a fully outsourced SOC. The company has strict data residency requirements and wants to maintain complete control over its security data. Which model is the most appropriate?
Select an answer first
7application · medium
A SOC analyst receives an alert from the SIEM about a suspicious outbound connection from a finance workstation to an unknown IP address. The alert lacks context about whether this is a known threat. According to standard SOC processes, what should the analyst do FIRST?
Select an answer first
8application · medium
During a major security incident, a SOC analyst discovers that the incident response plan is outdated and does not cover the type of attack that occurred. According to SOC best practices, what should the analyst do?
Select an answer first
9foundation · easy
Which tool is commonly used in a SOC to automate repetitive tasks and orchestrate response actions?
Select an answer first
10application · medium
A SOC manager is evaluating their team's maturity using a SOC maturity model. The team currently has documented processes, a SIEM, and a formal incident response plan, but they do not proactively hunt for threats. According to common maturity models, which stage best describes this SOC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Security Operations Center (SOC) Fundamentals CSA Practice Questions (Page 2)

Questions 6–10

A company is deciding between a fully in-house SOC and a fully outsourced SOC. The company has strict data residency requirements and wants to maintain complete control over its security data. Which model is the most appropriate?

A SOC analyst receives an alert from the SIEM about a suspicious outbound connection from a finance workstation to an unknown IP address. The alert lacks context about whether this is a known threat. According to standard SOC processes, what should the analyst do FIRST?

During a major security incident, a SOC analyst discovers that the incident response plan is outdated and does not cover the type of attack that occurred. According to SOC best practices, what should the analyst do?

Which tool is commonly used in a SOC to automate repetitive tasks and orchestrate response actions?

A SOC manager is evaluating their team's maturity using a SOC maturity model. The team currently has documented processes, a SIEM, and a formal incident response plan, but they do not proactively hunt for threats. According to common maturity models, which stage best describes this SOC?

Keep studying — Security Operations and Management