During an incident, a SOC analyst identifies a compromised host and wants to prevent further spread while preserving evidence. Which action aligns with the containment phase of the incident response workflow?

Isolate the host from the network while keeping it powered on for forensic analysis.

Change the host's IP address and continue monitoring.

Immediately reimage the host to eliminate the threat.

Shut down the host to stop malicious activity.

Which of the following is a common SOC tool used to detect suspicious activity on individual endpoints?

Endpoint Detection and Response (EDR)

Which of the following is an example of a threat intelligence indicator that can be integrated into SOC tools?

A network diagram of the organization

A list of approved software vendors

EC-CouncilSOC Essentials

Domain 4Objective 2

SOC Architecture and Infrastructure SCE Practice Questions (Page 11)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 51–53

51application · medium
During an incident, a SOC analyst identifies a compromised host and wants to prevent further spread while preserving evidence. Which action aligns with the containment phase of the incident response workflow?
Select an answer first
52foundation · easy
Which of the following is a common SOC tool used to detect suspicious activity on individual endpoints?
Select an answer first
53foundation · easy
Which of the following is an example of a threat intelligence indicator that can be integrated into SOC tools?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

SOC Architecture and Infrastructure SCE Practice Questions (Page 11)

Questions 51–53

During an incident, a SOC analyst identifies a compromised host and wants to prevent further spread while preserving evidence. Which action aligns with the containment phase of the incident response workflow?

Which of the following is a common SOC tool used to detect suspicious activity on individual endpoints?

Which of the following is an example of a threat intelligence indicator that can be integrated into SOC tools?

Keep studying — SOC Components and Architecture