SOC Components, Workflow, and Metrics CSA Practice Questions (Page 9)

Questions 41–41

1. 41application · medium

   A SOC team is being restructured to improve alert handling. Currently, analysts spend significant time on repetitive false positives, and there is no clear escalation path for confirmed incidents. The manager wants to implement a standard workflow that ensures every alert is evaluated, prioritized, and either closed or escalated with proper documentation. Which combination of SOC components should be emphasized?

   • AHiring more junior analysts and increasing the number of monitoring tools
   • BPurchasing a new threat intelligence feed and deploying additional endpoint sensors
   • CCreating a new analyst role focused solely on reporting and documentation
   • DImplementing a playbook for triage and escalation, and configuring the SIEM to auto-suppress known false positives
   Reveal Solution Discussion Select an answer first