Purpose and Importance of a SOC SCE Practice Questions (Page 8)

Questions 36–38

1. 36application · medium

   A startup with a cloud-native application wants to establish a function that monitors its AWS and Azure environments, correlates logs, and responds to security incidents. The team is small and cannot staff a 24/7 physical facility. Which approach best fits this requirement?

   • AImplement a virtual SOC using cloud-based SIEM and a follow-the-sun rotation of remote analysts.
   • BBuild a physical SOC with dedicated hardware and on-premises analysts.
   • CAssign one developer to check logs once a week.
   • DRely solely on the cloud provider's security alerts.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is deciding where to place its security monitoring and response functions. It wants a single team that can provide continuous visibility across the network, endpoints, and cloud environments, and that can also serve as the primary point of contact for security incidents. Which approach best meets this requirement?

   • AAssign monitoring duties to the network engineering team
   • BEstablish a centralized SOC with 24/7 monitoring and incident coordination
   • COutsource all security functions to a penetration testing vendor
   • DCreate separate teams for each environment without a central coordinator
   Reveal Solution Discussion Select an answer first
3. 38expert · hard

   A SOC analyst is investigating an alert that shows a user logging in from two different countries within 10 minutes. The user is a remote employee who frequently travels. The analyst must decide whether to escalate this alert. Which action is most appropriate?

   • AIgnore the alert because the user is a known traveler.
   • BDisable the user's account to prevent further access.
   • CImmediately escalate the alert as a confirmed compromise.
   • DCheck the user's travel schedule and VPN usage before deciding to escalate.
   Reveal Solution Discussion Select an answer first