SOC Components, Workflow, and Metrics CSA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company is building a SOC and needs to decide which components to include. The budget is limited, and the company wants to ensure that the SOC can operate effectively with a small team. Which component is most critical to include?

   • AA state-of-the-art security information and event management (SIEM) system
   • BA well-defined incident response process and trained analysts
   • CAn advanced threat intelligence platform
   • DA large team of analysts
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   During which phase of the SOC workflow does an analyst determine whether an alert is a true positive or a false positive?

   • AEradication
   • BTriage
   • CRecovery
   • DContainment
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A SOC has a high number of alerts, and the team is overwhelmed. The manager wants to improve efficiency without missing critical incidents. The team currently investigates every alert in order of arrival. The manager is considering implementing a priority-based triage system. Which approach best balances efficiency and coverage?

   • AAutomatically close all low-severity alerts without investigation
   • BInvestigate alerts in the order they arrive to ensure no alert is missed
   • CPrioritize alerts based on severity and potential impact, and investigate high-priority alerts first
   • DAssign all alerts to the most senior analyst for investigation
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC analyst is reviewing an alert that has been escalated as a true positive. The analyst has completed the initial investigation and has identified the affected systems. What should the analyst do next in the SOC workflow?

   • ARecover the systems
   • BClose the alert
   • CContain the incident
   • DEradicate the threat
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A SOC is struggling with a high number of alerts that are not actionable. The team spends most of its time on false positives, and as a result, MTTD has increased. The manager wants to improve MTTD without increasing the false positive rate. Which approach is most effective?

   • ADisable all alerts that have not been true positives in the past month
   • BHire more analysts to manually review all alerts
   • CImplement a threat intelligence feed to enrich alerts and prioritize them based on relevance
   • DIncrease the number of alerts sent to the SIEM to ensure no incident is missed
   Reveal Solution Discussion Select an answer first