Purpose and Importance of a SOC SCE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is a Security Operations Center (SOC) critical for maintaining an organization's security posture?

   • AIt provides continuous monitoring and rapid response, reducing the time to detect and contain threats.
   • BIt guarantees that no security incident will ever occur.
   • CIt eliminates the need for other security controls such as firewalls and antivirus.
   • DIt focuses only on compliance reporting and does not affect security posture.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is NOT a core function of a SOC?

   • AIncident response and remediation.
   • BThreat detection and analysis.
   • CSoftware development and coding.
   • DSecurity reporting and metrics.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC analyst notices a series of failed logins followed by a successful login from an unusual geographic location. The analyst escalates the event to the incident response team, which confirms a compromised account and resets it. Which sequence best describes the SOC's role in this scenario?

   • ADetect the anomaly, analyze its context, and coordinate the response.
   • BIgnore the event because the login succeeded and the user may have been traveling.
   • CPrevent the login by blocking all foreign IP addresses in advance.
   • DImmediately disconnect the user's account without further analysis.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A retail company experiences a data breach that exposes customer payment information. The breach is discovered by a customer, not by the company. The company's leadership wants to avoid this situation in the future. Which SOC capability is most directly relevant?

   • ADeveloping a customer notification plan for after a breach.
   • BPurchasing cyber insurance to cover breach costs.
   • CProactive monitoring and threat hunting to detect breaches earlier.
   • DHiring a public relations firm to manage the breach announcement.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is reorganizing its security functions. The SOC currently performs alert triage and escalates confirmed incidents. The incident response team handles containment. The security engineering team builds detection rules. The threat intelligence team provides context. After a major incident, a review finds that the SOC was overwhelmed by low-priority alerts and missed a critical one. Which change would most directly address this problem?

   • AImplement a triage process that filters low-priority alerts and escalates only high-fidelity ones to senior analysts.
   • BAsk the threat intelligence team to respond to alerts.
   • CIncrease the number of alerts monitored by the SOC.
   • DTransfer all alert triage to the incident response team.
   Reveal Solution Discussion Select an answer first