A SOC has two teams: the Level 1 analysts who monitor real-time alerts and the Level 2 incident responders who investigate deep-dive cases. The SOC manager wants to provide each team with a dashboard tailored to their role. What is the best approach?

Create two separate dashboards: one with a real-time alert feed and basic metrics for Level 1, and another with detailed investigation panels and historical search for Level 2.

Create a single dashboard that includes all possible widgets for both teams, so everyone sees everything.

Let each analyst build their own personal dashboard from scratch without any guidance.

Use the same dashboard for both teams but change the time range filter to 'last 24 hours' for Level 1 and 'last 7 days' for Level 2.

What is the main advantage of scheduling a security report to be generated automatically?

It reduces the storage space required for logs

It automatically resolves all security incidents

It ensures stakeholders receive regular, up-to-date reports without manual effort

It eliminates the need for any human review of the report

A SOC team wants to detect a potential data exfiltration attack that involves multiple users uploading data to an external cloud storage service. The team has a correlation rule that triggers when a single user uploads more than 100 MB within 15 minutes. However, the team is concerned that an attacker might distribute the upload across multiple user accounts to evade the rule. What is the best way to adjust the correlation rule to address this concern?

Disable the existing rule and rely on manual monitoring of upload logs.

Change the existing rule to trigger on any upload to external cloud storage, regardless of volume or time window.

Increase the threshold of the existing rule to 200 MB to reduce false positives.

Create a new correlation rule that triggers when the total upload volume from multiple users to the same external cloud storage service exceeds 100 MB within a 15-minute window.

A SOC manager wants to automatically send a weekly summary of all security alerts to the IT director every Monday at 8:00 AM. The report should be generated from the SIEM data. What is the best way to configure this?

Export the raw logs to a file and send it to the IT director weekly.

Create a dashboard that shows the weekly summary and share the link with the IT director.

Create a report that runs on a schedule and set up an email distribution list that includes the IT director.

Manually generate the report every Monday and email it to the IT director.

EC-CouncilSOC Essentials

Domain 6Objective 2

Correlation Rules, Dashboards, and Reports SCE Practice Questions (Page 2)

Part of the Incident Detection and Analysis domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

10concepts

Questions 6–10

6application · medium
A SOC has two teams: the Level 1 analysts who monitor real-time alerts and the Level 2 incident responders who investigate deep-dive cases. The SOC manager wants to provide each team with a dashboard tailored to their role. What is the best approach?
Select an answer first
7foundation · easy
What is the main advantage of scheduling a security report to be generated automatically?
Select an answer first
8expert · hard
A SOC team wants to detect a potential data exfiltration attack that involves multiple users uploading data to an external cloud storage service. The team has a correlation rule that triggers when a single user uploads more than 100 MB within 15 minutes. However, the team is concerned that an attacker might distribute the upload across multiple user accounts to evade the rule. What is the best way to adjust the correlation rule to address this concern?
Select an answer first
9application · easy
A SOC manager wants to automatically send a weekly summary of all security alerts to the IT director every Monday at 8:00 AM. The report should be generated from the SIEM data. What is the best way to configure this?
Select an answer first
10foundation · easy
A SOC manager wants to display the trend of phishing emails reported over the past month. Which widget is the best choice?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Correlation Rules, Dashboards, and Reports SCE Practice Questions (Page 2)

Questions 6–10

A SOC has two teams: the Level 1 analysts who monitor real-time alerts and the Level 2 incident responders who investigate deep-dive cases. The SOC manager wants to provide each team with a dashboard tailored to their role. What is the best approach?

What is the main advantage of scheduling a security report to be generated automatically?

A SOC manager wants to automatically send a weekly summary of all security alerts to the IT director every Monday at 8:00 AM. The report should be generated from the SIEM data. What is the best way to configure this?

A SOC manager wants to display the trend of phishing emails reported over the past month. Which widget is the best choice?

Keep studying — Incident Detection and Analysis