Purpose and Importance of a SOC SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A mid-sized financial firm has a small IT team that handles both infrastructure support and security. After a malware outbreak disrupted operations for two days, the board asks for a dedicated function that continuously watches for threats, triages alerts, and coordinates containment with the existing IT staff. Which approach best addresses the board's request?

   • AOutsource all security responsibilities to a managed security service provider and disband internal IT security duties.
   • BEstablish a SOC that provides continuous monitoring, alert triage, and incident coordination.
   • CCreate a threat intelligence team to research emerging malware families and publish advisories.
   • DPurchase an endpoint detection and response tool and assign the IT team to review its alerts weekly.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's SOC has been operating for a year. Management asks the SOC manager to demonstrate the value of the SOC in terms of risk reduction and operational efficiency. Which metric would best demonstrate this value?

   • ANumber of security tools deployed
   • BReduction in mean time to detect (MTTD) and mean time to respond (MTTR)
   • CTotal number of alerts generated
   • DSize of the SOC team
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization is implementing a SOC to reduce the likelihood of prolonged downtime from ransomware attacks and to meet regulatory requirements for timely breach notification. Which SOC capability is most directly aligned with these goals?

   • AVulnerability scanning of external-facing systems
   • B24/7 monitoring and rapid incident detection
   • CSecurity awareness training for employees
   • DPeriodic penetration testing of critical applications
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC analyst is reviewing a dashboard that shows a sudden increase in failed login attempts from a single IP address. The analyst checks the source, correlates it with other logs, and determines it is a brute-force attack. The analyst then blocks the IP and reports the action. Which sequence of SOC functions did the analyst perform?

   • AMonitoring, detection, and reporting only
   • BMonitoring, detection, analysis, response, and reporting
   • CAnalysis, response, and monitoring only
   • DDetection, reporting, and monitoring only
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A manufacturing company experiences a ransomware attack that encrypts its production scheduling servers. The company's leadership asks why a SOC would have been valuable before the attack. Which benefit best answers this question?

   • AA SOC would have guaranteed that no malware could ever enter the network.
   • BA SOC could have detected early indicators of compromise and initiated a faster response, reducing business disruption.
   • CA SOC would have eliminated the need for backups and disaster recovery planning.
   • DA SOC would have automatically patched all vulnerabilities before the attack.
   Reveal Solution Discussion Select an answer first