Which technology is used in a SOC to collect and aggregate logs from various sources for analysis?

Intrusion Prevention System (IPS)

SIEM (Security Information and Event Management)

A company's leadership asks the SOC manager to justify the existence of the SOC by explaining its primary purpose. Which statement BEST captures the primary purpose of a SOC?

To continuously monitor, detect, analyze, and respond to cybersecurity incidents

To perform regular penetration testing of all applications

To develop and enforce all organizational security policies

To manage the deployment of security patches across the enterprise

Which best practice helps address the challenge of alert fatigue in a SOC?

Disabling all alerts to reduce noise

Regularly tuning detection rules to reduce false positives

Increasing the number of alerts monitored

Assigning all alerts to a single analyst

A mid-sized financial firm is building a SOC to monitor its hybrid infrastructure (on-premises core banking systems and cloud-based customer portals). They have a small security team with limited specialized skills and want to ensure 24/7 coverage without hiring a large in-house staff. Which SOC model best fits their constraints?

Virtual SOC with no dedicated staff, relying solely on automated alerting

Fully outsourced SOC with no in-house security staff

Fully in-house SOC with 24/7 shifts staffed by rotating generalists

Hybrid SOC with in-house daytime analysts and a managed security service provider (MSSP) covering nights and weekends

EC-CouncilCertified SOC Analyst

Domain 1Objective 1

Security Operations Center (SOC) Fundamentals CSA Practice Questions (Page 6)

Part of the Security Operations and Management domain, which makes up ~12% of our current practice bank.

45questions here

9free pages

8concepts

Questions 26–30

26foundation · easy
Which technology is used in a SOC to collect and aggregate logs from various sources for analysis?
Select an answer first
27application · easy
A company's leadership asks the SOC manager to justify the existence of the SOC by explaining its primary purpose. Which statement BEST captures the primary purpose of a SOC?
Select an answer first
28application · medium
A SOC manager wants to measure how effectively the team is detecting and responding to threats. They want a metric that reflects the time from when an alert is created to when it is resolved. Which KPI should they track?
Select an answer first
29foundation · easy
Which best practice helps address the challenge of alert fatigue in a SOC?
Select an answer first
30application · medium
A mid-sized financial firm is building a SOC to monitor its hybrid infrastructure (on-premises core banking systems and cloud-based customer portals). They have a small security team with limited specialized skills and want to ensure 24/7 coverage without hiring a large in-house staff. Which SOC model best fits their constraints?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Security Operations Center (SOC) Fundamentals CSA Practice Questions (Page 6)

Questions 26–30

Which technology is used in a SOC to collect and aggregate logs from various sources for analysis?

A company's leadership asks the SOC manager to justify the existence of the SOC by explaining its primary purpose. Which statement BEST captures the primary purpose of a SOC?

A SOC manager wants to measure how effectively the team is detecting and responding to threats. They want a metric that reflects the time from when an alert is created to when it is resolved. Which KPI should they track?

Which best practice helps address the challenge of alert fatigue in a SOC?

Keep studying — Security Operations and Management