A SOC is struggling with alert fatigue because analysts are overwhelmed by the volume of alerts. The SOC manager wants to improve the situation without increasing staff. Which approach would be most effective?

Disabling all low-priority alerts

Requiring analysts to investigate every alert

Increasing the sensitivity of the SIEM rules

Implementing alert deduplication and correlation rules

What is the primary goal of a SOC maturity model?

To compare SOC performance against competitors

To replace the need for incident response plans

To provide a roadmap for improving SOC capabilities over time

During a routine shift, a SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst has verified the alert is a true positive. According to standard SOC procedures, what should the analyst do NEXT?

Document the alert and close it as resolved

Wait for the user to report the issue before taking action

Escalate the incident to the incident response team or follow the established incident response plan

Immediately isolate the workstation from the network

EC-CouncilCertified SOC Analyst

Domain 1Objective 1

Security Operations Center (SOC) Fundamentals CSA Practice Questions (Page 4)

Part of the Security Operations and Management domain, which makes up ~12% of our current practice bank.

45questions here

9free pages

8concepts

Questions 16–20

16application · medium
A SOC is struggling with alert fatigue because analysts are overwhelmed by the volume of alerts. The SOC manager wants to improve the situation without increasing staff. Which approach would be most effective?
Select an answer first
17foundation · easy
What is the primary goal of a SOC maturity model?
Select an answer first
18application · medium
A multinational corporation is establishing a SOC to provide 24/7 monitoring for its global operations. The company has a limited budget and wants to leverage external expertise while maintaining internal control over incident response. Which SOC organizational model best fits these requirements?
Select an answer first
19application · medium
During a routine shift, a SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst has verified the alert is a true positive. According to standard SOC procedures, what should the analyst do NEXT?
Select an answer first
20foundation · easy
Which SOC organizational model involves a third-party vendor providing monitoring and response services from an external facility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Security Operations Center (SOC) Fundamentals CSA Practice Questions (Page 4)

Questions 16–20

A SOC is struggling with alert fatigue because analysts are overwhelmed by the volume of alerts. The SOC manager wants to improve the situation without increasing staff. Which approach would be most effective?

What is the primary goal of a SOC maturity model?

A multinational corporation is establishing a SOC to provide 24/7 monitoring for its global operations. The company has a limited budget and wants to leverage external expertise while maintaining internal control over incident response. Which SOC organizational model best fits these requirements?

During a routine shift, a SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst has verified the alert is a true positive. According to standard SOC procedures, what should the analyst do NEXT?

Which SOC organizational model involves a third-party vendor providing monitoring and response services from an external facility?

Keep studying — Security Operations and Management