SOC Components, Workflow, and Metrics CSA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC analyst is reviewing the previous week's alert data. There were 500 alerts generated, 100 of which were escalated as incidents. Of those escalated, 80 were confirmed as true positives. What is the false positive rate for the week?

   • A20%
   • B84%
   • C80%
   • D16%
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company is building a SOC and must decide between a centralized SOC and a distributed SOC model. The company has offices in three different countries and wants to ensure compliance with local data residency regulations. Which SOC model is most appropriate?

   • ADistributed SOC with local data collection and analysis in each country
   • BCentralized SOC with all data stored in one country
   • CCentralized SOC with data encrypted in transit and at rest
   • DDistributed SOC with all data replicated to a central location
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC analyst is reviewing an alert that the SIEM flagged as 'high severity'. The analyst checks the raw logs, correlates with threat intelligence, and determines that the alert is a false positive due to a misconfigured internal application. According to the SOC workflow, what should the analyst do next?

   • ADisable the SIEM rule permanently
   • BEscalate the alert to the incident response team
   • CClose the alert and document the reason
   • DIgnore the alert without any action
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC analyst is handling an incident that has been confirmed as a true positive. The analyst has already contained the threat and is now working on removing the malicious files and closing the vulnerabilities. Which phase of the incident response workflow is the analyst performing?

   • AEradication
   • BRecovery
   • CDetection
   • DContainment
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A SOC analyst receives an alert from the SIEM indicating a possible malware infection on a workstation. The analyst investigates and finds that the file is actually a legitimate software updater. According to a typical SOC workflow, what should the analyst do next?

   • AUpdate the SIEM correlation rule to block the software updater
   • BDisable the workstation's network access to prevent potential spread
   • CEscalate the alert to the incident response team for further investigation
   • DClose the alert as a false positive and document the reason
   Reveal Solution Discussion Select an answer first