Security Operations Center (SOC) Fundamentals CSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a typical SOC, which role is primarily responsible for triaging alerts and determining whether they are true positives?

   • AThreat Hunter
   • BSecurity Analyst (Level 1)
   • CSOC Manager
   • DIncident Responder
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC is considering deploying a new EDR solution to improve endpoint visibility. However, the SOC manager is concerned about the potential increase in alerts and the impact on the team's workload. Which strategy would best address this concern?

   • AIntegrating the EDR with the SIEM and tuning detection rules
   • BHiring additional analysts before deploying the EDR
   • CDeploying the EDR solution without any tuning
   • DDeploying the EDR only on critical servers
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is considering whether to build a SOC or use a co-managed SOC model. The company has a small internal security team but wants to maintain some control over security operations. Which model would best meet this need?

   • AVirtual SOC
   • BFully outsourced SOC
   • CIn-house SOC
   • DCo-managed SOC
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of a playbook in a SOC?

   • ATo record the results of penetration tests
   • BTo document the organization's security policies and procedures
   • CTo provide step-by-step instructions for responding to specific types of incidents
   • DTo list the hardware and software inventory of the SOC
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC manager is planning to advance their SOC from a 'Managed' to a 'Proactive' maturity stage. The team currently has a SIEM, documented processes, and a 24/7 monitoring capability. However, the organization has a limited budget and the team is already stretched thin. Which initiative would BEST achieve the goal of becoming more proactive while respecting the budget and workload constraints?

   • AIncrease the number of analysts to allow time for proactive activities
   • BImplement a full threat hunting program with dedicated hunters and advanced analytics
   • CIntegrate threat intelligence feeds into the SIEM and create automated alert enrichment
   • DReplace the current SIEM with a next-generation platform that includes built-in threat hunting
   Reveal Solution Discussion Select an answer first