SOC Components, Workflow, and Metrics CSA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC manager is comparing two metrics: MTTD and MTTR. The team has recently improved its detection capabilities, but the MTTR has not improved. The manager suspects that the response process is the bottleneck. Which action would most directly help improve MTTR?

   • AImplement automated containment playbooks for common incident types
   • BIncrease the sensitivity of the SIEM rules to detect more incidents
   • CFocus on improving the false positive rate
   • DReduce the number of analysts on the response team
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC is planning to expand its operations to a 24/7 model. The current team works 8-hour shifts, Monday to Friday. The manager must ensure that all alerts are triaged within 15 minutes of arrival. The team has a high false positive rate, and analysts spend significant time on false positives. Which combination of SOC components should the manager address to meet the 15-minute triage goal?

   • AOnly add more analysts
   • BIncrease the severity threshold for alerts
   • CAdd more analysts and improve the SIEM rules to reduce false positives
   • DOnly improve the SIEM rules
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following best describes the three core components of a Security Operations Center (SOC)?

   • AHardware, software, and network
   • BPrevention, detection, and response
   • CAnalysts, managers, and executives
   • DPeople, processes, and technology
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC manager wants to reduce the time it takes to detect security incidents. The team currently has an MTTD of 12 hours. Which improvement would most directly reduce MTTD?

   • AHire more SOC analysts
   • BDeploy additional endpoint detection and response (EDR) sensors
   • CImprove the incident response runbooks
   • DIncrease the frequency of threat intelligence updates
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst is investigating an alert that has been escalated to a potential incident. The analyst has gathered initial evidence and believes the incident is real. According to the SOC workflow, what should the analyst do next?

   • AClose the alert as a false positive
   • BEscalate the incident to the incident response team with all gathered evidence
   • CContain the threat immediately to prevent further damage
   • DWait for additional alerts before taking action
   Reveal Solution Discussion Select an answer first