A global enterprise operates a SOC that follows the sun model, with teams in three geographic regions. A security incident occurs in the Asia-Pacific region during the local team's shift. According to the follow-the-sun model, what should happen when the Asia-Pacific shift ends?

The incident is handed over to the next regional team with detailed documentation

The incident is closed because the shift is over

The incident is escalated to the global SOC manager for a decision

The incident is put on hold until the Asia-Pacific team returns the next day

What does a high false positive rate in a SOC indicate?

The SOC is missing many attacks

The SOC is responding too slowly to incidents

The SOC is generating many alerts that are not actual incidents

The SOC is detecting many true threats

A SOC analyst is reviewing a high-priority alert that was generated by the SIEM. The alert indicates a potential data exfiltration from a database server. According to the SOC's procedures, what should the analyst do first?

Verify the alert and assess the severity and impact

Escalate the alert to the incident response team immediately

Immediately isolate the database server from the network

Contact the database administrator to change the server's password

EC-CouncilCertified SOC Analyst

Domain 1Objective 1

Security Operations Center (SOC) Fundamentals CSA Practice Questions (Page 5)

Part of the Security Operations and Management domain, which makes up ~12% of our current practice bank.

45questions here

9free pages

8concepts

Questions 21–25

21foundation · easy
Which SOC maturity model stage is characterized by ad-hoc processes and minimal formal documentation?
Select an answer first
22application · medium
A global enterprise operates a SOC that follows the sun model, with teams in three geographic regions. A security incident occurs in the Asia-Pacific region during the local team's shift. According to the follow-the-sun model, what should happen when the Asia-Pacific shift ends?
Select an answer first
23foundation · easy
What does a high false positive rate in a SOC indicate?
Select an answer first
24application · medium
During a major security incident, a SOC analyst discovers that the incident response plan does not cover the specific type of attack that occurred. The analyst is unsure who has the authority to make decisions outside the existing plan. Which role in the SOC is typically responsible for making such decisions during an incident?
Select an answer first
25application · medium
A SOC analyst is reviewing a high-priority alert that was generated by the SIEM. The alert indicates a potential data exfiltration from a database server. According to the SOC's procedures, what should the analyst do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Security Operations Center (SOC) Fundamentals CSA Practice Questions (Page 5)

Questions 21–25

Which SOC maturity model stage is characterized by ad-hoc processes and minimal formal documentation?

A global enterprise operates a SOC that follows the sun model, with teams in three geographic regions. A security incident occurs in the Asia-Pacific region during the local team's shift. According to the follow-the-sun model, what should happen when the Asia-Pacific shift ends?

What does a high false positive rate in a SOC indicate?

A SOC analyst is reviewing a high-priority alert that was generated by the SIEM. The alert indicates a potential data exfiltration from a database server. According to the SOC's procedures, what should the analyst do first?

Keep studying — Security Operations and Management