Purpose and Importance of a SOC SCE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary difference between a SOC and a threat intelligence team?

   • AThe SOC is a subset of the threat intelligence team.
   • BThe SOC is responsible for threat hunting, while the threat intelligence team is responsible for incident response.
   • CThe SOC focuses on monitoring and responding to incidents, while the threat intelligence team focuses on gathering and analyzing information about potential threats.
   • DThe threat intelligence team is responsible for monitoring network traffic, while the SOC analyzes malware.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational company must comply with data protection regulations that require security incident reporting within 72 hours. The company's SOC is centralized in one region and does not monitor systems in other regions during their business hours. The compliance team warns that delayed detection could cause missed reporting deadlines. Which change best addresses this risk?

   • AMove all systems to the SOC's region to simplify monitoring.
   • BExtend SOC coverage to 24/7 using follow-the-sun shifts across regions.
   • CReduce the number of monitored systems to lower alert volume.
   • DIncrease the reporting deadline to 96 hours to allow more time.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's SOC produces weekly reports showing the number of alerts, false positives, and mean time to respond. The board asks how these metrics demonstrate the SOC's value. Which explanation is most accurate?

   • AThe metrics are used solely to justify the SOC's budget.
   • BThe metrics prove that no security incidents have occurred.
   • CThe metrics show the SOC is reducing risk by improving detection and response efficiency.
   • DThe metrics are only useful for compliance and have no operational value.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC is implementing a new SIEM. The team must decide which log sources to ingest first. The company has limited storage and cannot ingest all sources immediately. Which approach best prioritizes log sources to support the SOC's core functions?

   • APrioritize logs from critical systems and authentication sources, which are most likely to reveal security incidents.
   • BIngest logs from the least critical systems first to test the SIEM.
   • CIngest only firewall logs because they show all network traffic.
   • DIngest all logs equally to avoid missing any potential threat.
   Reveal Solution Discussion Select an answer first
6. 10application · easy

   A SOC team is defining its daily responsibilities. The team wants to ensure it covers the core functions of a SOC. Which list best represents the core functions?

   • APenetration testing, vulnerability scanning, and compliance auditing.
   • BEmployee training, policy development, and risk assessment.
   • CMonitoring, threat detection, incident response, and reporting.
   • DPatch management, firewall configuration, and software development.
   Reveal Solution Discussion Select an answer first