SOC Components, Workflow, and Metrics CSA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC is being designed for a financial institution that must comply with strict regulatory requirements. The SOC will handle sensitive customer data. Which component is most important to ensure compliance?

   • AA large team of analysts to manually review all logs
   • BA state-of-the-art threat intelligence platform
   • CA dedicated compliance officer
   • DA robust logging and monitoring system that retains logs for the required period
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SOC is planning to implement a new incident response process. The team is distributed across multiple time zones, and there is no single source of truth for incident status. The manager wants to improve collaboration and ensure that all analysts follow the same workflow. Which approach is most effective?

   • AHold a daily conference call to review all incidents
   • BCreate a spreadsheet that is updated by each analyst at the end of their shift
   • CUse email for all incident communication and status updates
   • DDeploy a shared ticketing system with defined workflow states and mandatory documentation
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is establishing a SOC and wants to ensure that the team can effectively monitor, detect, and respond to security incidents. The budget is limited, so they cannot afford a full suite of advanced tools. Which approach best balances people, process, and technology?

   • AInvest heavily in a next-generation SIEM and hire a small team of analysts
   • BFocus on hiring experienced analysts and rely on manual monitoring
   • COutsource all monitoring to a managed security service provider (MSSP)
   • DImplement a basic SIEM, define clear processes, and train analysts to follow them
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC is implementing a new SIEM platform. The team needs to ensure that the SIEM receives logs from all critical servers and network devices. Which SOC component is being configured?

   • AFacilities
   • BTechnology
   • CProcess
   • DPeople
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the correct sequence of the typical SOC workflow from alert to closure?

   • AContainment → Eradication → Recovery → Triage → Investigation → Reporting
   • BInvestigation → Triage → Reporting → Containment → Recovery → Eradication
   • CTriage → Investigation → Containment → Eradication → Recovery → Reporting
   • DReporting → Triage → Investigation → Containment → Recovery → Eradication
   Reveal Solution Discussion Select an answer first