SOC Components, Workflow, and Metrics CSA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC manager is reviewing the monthly metrics. The MTTD is 2 hours, MTTR is 6 hours, and the false positive rate is 90%. The team is small and cannot handle more alerts. The manager wants to improve the metrics but has a limited budget. Which initiative should be prioritized?

   • AHire additional analysts to handle more alerts
   • BIncrease the frequency of threat intelligence updates
   • CFocus on tuning the current SIEM rules to reduce false positives
   • DInvest in a new SIEM platform with advanced analytics
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC receives 500 alerts in one week. After investigation, 75 alerts are confirmed as true positives. What is the false positive rate for that week?

   • A75%
   • B15%
   • C25%
   • D85%
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a SOC, which component is primarily responsible for defining the steps analysts follow when investigating an alert?

   • AFacilities
   • BProcesses
   • CTechnology
   • DPeople
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC analyst is investigating an alert that was escalated as a true positive. The analyst has confirmed the incident and is now working with the incident response team to contain the threat. The team is debating whether to isolate the affected host or disconnect it from the network. Which factor is most important in this decision?

   • AThe cost of the affected host
   • BThe severity of the incident
   • CThe need to preserve forensic evidence
   • DThe number of users affected
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC manager is reviewing the team's performance metrics. The team has an MTTD of 1 hour, an MTTR of 4 hours, and a false positive rate of 90%. The manager wants to improve the team's efficiency. Which metric should the manager prioritize to have the most significant impact on the team's overall effectiveness?

   • AAll metrics equally
   • BMTTR
   • CMTTD
   • DFalse positive rate
   Reveal Solution Discussion Select an answer first