Security Operations Center (SOC) Fundamentals CSA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A SOC analyst receives an alert from the SIEM about a possible brute-force attack on a user account. The analyst checks the logs and confirms that the attack is ongoing. According to the SOC's procedures, what should the analyst do next?

   • AIgnore the alert and continue monitoring
   • BEscalate the alert to the incident response team
   • CDisable the user account immediately
   • DChange the user's password
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A SOC analyst is investigating a potential data exfiltration incident. The SIEM shows a large outbound data transfer from a server to an external IP. The analyst needs to confirm whether the transfer is malicious. Which combination of actions would provide the MOST reliable confirmation?

   • ACheck the server's baseline behavior and compare the transfer to known legitimate patterns
   • BImmediately block the external IP address
   • CReview the firewall logs for any previous connections to the same IP
   • DAsk the server administrator if the transfer was expected
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which statement best defines a Security Operations Center (SOC)?

   • AA centralized unit that monitors, detects, analyzes, and responds to security incidents in real time
   • BA team that develops and implements security policies and conducts risk assessments
   • CA facility that houses servers and network equipment for an organization's IT infrastructure
   • DA group that performs penetration testing and vulnerability scanning on a scheduled basis
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A SOC team is overwhelmed by a high volume of low-fidelity alerts from their SIEM, causing analysts to miss critical alerts. Which combination of tools and processes would BEST address this issue?

   • ASwitch to a different SIEM platform with better default rules
   • BDisable all alerts that are not marked as critical
   • CIncrease the number of analysts on duty to manually review all alerts
   • DImplement SOAR to automate alert triage and enrichment, and tune SIEM correlation rules
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which process is typically used in a SOC to ensure that alerts are systematically reviewed and resolved?

   • AIncident response plan
   • BTicketing system workflow
   • CVulnerability management program
   • DPenetration testing schedule
   Reveal Solution Discussion Select an answer first