Security Operations Center (SOC) Fundamentals CSA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC is struggling with a high false positive rate, causing analysts to ignore alerts. The SOC manager wants to reduce false positives without missing real threats. Which approach BEST balances these competing concerns?

   • AIncrease the severity threshold for all alerts so only critical alerts are generated
   • BAdd more SIEM correlation rules to catch more potential threats
   • CDisable all alerts that have historically been false positives
   • DImplement a feedback loop where analysts mark false positives and use that data to tune correlation rules
   Reveal Solution Discussion Select an answer first
2. 37application · easy

   A SOC team needs to collect and analyze network traffic to detect anomalies and potential intrusions. Which technology is specifically designed for this purpose?

   • AEndpoint Detection and Response (EDR)
   • BNetwork Intrusion Detection System (NIDS)
   • CVulnerability Scanner
   • DSIEM
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC analyst is investigating a suspicious email that was flagged by the email gateway. The analyst needs to determine if the email is part of a larger phishing campaign targeting the organization. Which tool would be most effective for this analysis?

   • AA vulnerability scanner to check the email's attachments
   • BA ticketing system to track the investigation
   • CA packet analyzer to inspect network traffic
   • DA SIEM to correlate the email with other security events
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC is experiencing high analyst turnover, leading to a loss of institutional knowledge and inconsistent incident handling. Which best practice would MOST effectively address this challenge?

   • AIncrease analyst salaries to reduce turnover
   • BReduce the number of alerts to lower analyst workload
   • CImplement a comprehensive documentation and knowledge management system
   • DOutsource the SOC to an MSSP to avoid hiring issues
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A multinational corporation is deciding between a centralized SOC and a distributed SOC model. They have operations in multiple regions with different regulatory requirements and want to ensure local compliance while maintaining global visibility. Which approach BEST meets these needs?

   • AFully outsourced SOC to a global MSSP with no internal teams
   • BCentralized SOC with all monitoring and analysis performed from a single location
   • CDistributed SOC with regional teams that report to a central coordination hub
   • DVirtual SOC with no physical presence, using cloud-based tools only
   Reveal Solution Discussion Select an answer first