A SOC is designing its infrastructure to support both real-time alerting and long-term forensic analysis. The team is concerned about the cost and performance of storing all raw logs in the SIEM. Which architecture would best balance real-time detection and long-term storage needs?

Store all raw logs only in the SIEM for the maximum retention period

Use a log management system for real-time alerting and the SIEM for long-term storage

Do not store raw logs; rely only on alerts generated by the SIEM

Use the SIEM for real-time correlation and alerting, and archive raw logs to a separate cost-optimized storage tier

A SOC has been operating at a 'defined' maturity level for two years. The team wants to advance to the 'managed' level but has limited budget and staff. Which initiative would provide the MOST impactful improvement toward that goal?

Increase the number of analysts on the team

Implement a threat intelligence program

Purchase a new SIEM platform with more features

Establish formal service-level agreements (SLAs) for incident response and track performance against them

What is the primary function of a SIEM system in a SOC?

To provide a ticketing system for incident tracking

To patch vulnerabilities on endpoints automatically

To block malicious network traffic in real time

To collect, correlate, and analyze security events from multiple sources

A mid-sized company is building a SOC and needs to collect security-relevant data from on-premises servers, cloud workloads, and employee endpoints. The team wants a single platform to normalize and correlate the data for alerting. Which approach best meets this requirement?

Use a ticketing system to collect and store all security logs from each source.

Deploy a SIEM platform and configure log forwarders on each source to send data to it.

Set up a shared network folder where each team manually uploads logs for review.

Install a standalone intrusion detection system on the network perimeter and review its alerts manually.

A SOC analyst notices that the SIEM is generating a high volume of alerts for a known malware family, but many are false positives. The team wants to reduce noise while improving detection of actual infections. Which approach best leverages threat intelligence to achieve this?

Create correlation rules that reference indicators of compromise (IOCs) from a threat intelligence feed

Disable all alerts for the malware family to reduce noise

Increase the log retention period for all sources

Add more network sensors to capture additional traffic

EC-CouncilSOC Essentials

Domain 4Objective 2

SOC Architecture and Infrastructure SCE Practice Questions (Page 3)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 11–15

11expert · hard
A SOC is designing its infrastructure to support both real-time alerting and long-term forensic analysis. The team is concerned about the cost and performance of storing all raw logs in the SIEM. Which architecture would best balance real-time detection and long-term storage needs?
Select an answer first
12expert · hard
A SOC has been operating at a 'defined' maturity level for two years. The team wants to advance to the 'managed' level but has limited budget and staff. Which initiative would provide the MOST impactful improvement toward that goal?
Select an answer first
13foundation · easy
What is the primary function of a SIEM system in a SOC?
Select an answer first
14application · medium
A mid-sized company is building a SOC and needs to collect security-relevant data from on-premises servers, cloud workloads, and employee endpoints. The team wants a single platform to normalize and correlate the data for alerting. Which approach best meets this requirement?
Select an answer first
15application · medium
A SOC analyst notices that the SIEM is generating a high volume of alerts for a known malware family, but many are false positives. The team wants to reduce noise while improving detection of actual infections. Which approach best leverages threat intelligence to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.