During a major incident, a SOC team is split between containing the threat and preserving forensic evidence. The incident is spreading rapidly, and the team must decide whether to isolate affected systems immediately or first collect volatile data. Which approach best balances containment and evidence preservation?

Disconnect the affected systems from power to preserve memory

Collect all forensic evidence before taking any containment action

Isolate the affected systems from the network first, then collect forensic evidence from the isolated systems

Immediately reimage all affected systems to eradicate the threat

What is the primary purpose of a ticketing system in a SOC?

To track and manage incidents and tasks throughout their lifecycle

To block malicious network traffic

A SOC is experiencing a high volume of SIEM alerts, many of which are false positives. Analysts are overwhelmed and missing critical alerts. The team wants to improve alert quality without losing visibility. Which approach is most effective?

Increase the number of analysts to handle the alert volume.

Tune correlation rules and implement alert prioritization based on asset criticality.

Disable all correlation rules that generate more than 10 alerts per day.

Increase the SIEM's log retention period to allow more historical analysis.

EC-CouncilSOC Essentials

Domain 4Objective 2

SOC Architecture and Infrastructure SCE Practice Questions (Page 5)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 21–25

21expert · hard
During a major incident, a SOC team is split between containing the threat and preserving forensic evidence. The incident is spreading rapidly, and the team must decide whether to isolate affected systems immediately or first collect volatile data. Which approach best balances containment and evidence preservation?
Select an answer first
22application · medium
A SOC is implementing a new incident response workflow. The team wants to ensure that the right people are notified and involved at each stage of an incident. Which component of the SOC is most critical to define this?
Select an answer first
23foundation · easy
Which of the following is NOT one of the three core components of a SOC?
Select an answer first
24foundation · easy
What is the primary purpose of a ticketing system in a SOC?
Select an answer first
25expert · hard
A SOC is experiencing a high volume of SIEM alerts, many of which are false positives. Analysts are overwhelmed and missing critical alerts. The team wants to improve alert quality without losing visibility. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

SOC Architecture and Infrastructure SCE Practice Questions (Page 5)

Questions 21–25

A SOC is implementing a new incident response workflow. The team wants to ensure that the right people are notified and involved at each stage of an incident. Which component of the SOC is most critical to define this?

Which of the following is NOT one of the three core components of a SOC?

What is the primary purpose of a ticketing system in a SOC?

A SOC is experiencing a high volume of SIEM alerts, many of which are false positives. Analysts are overwhelmed and missing critical alerts. The team wants to improve alert quality without losing visibility. Which approach is most effective?

Keep studying — SOC Components and Architecture