A SOC is integrating multiple threat intelligence feeds into its SIEM. The team notices that some feeds are causing a high number of false positives because they contain outdated or low-confidence indicators. The SOC wants to maintain high detection fidelity while still benefiting from external intelligence. Which approach is the most balanced?

Increase the SIEM alert threshold to reduce the number of alerts

Remove all external threat intelligence feeds and rely only on internal detection

Use all indicators from all feeds without filtering

Apply confidence scores and age thresholds to indicators before using them in correlation rules

During an incident, a SOC analyst discovers that the containment action taken earlier was ineffective because the attacker had already established persistence on multiple hosts. The team needs to revise its approach. Which action best addresses the situation?

Ignore the persistence and focus on restoring business operations.

Shut down the entire network to stop the attack.

Expand containment to all affected hosts and initiate eradication procedures.

Reimage only the initially compromised host and continue monitoring.

A SOC is experiencing a high rate of alerts that are not being investigated promptly because analysts are overwhelmed. The manager wants to improve the efficiency of the SOC by better integrating people, processes, and technology. Which change would BEST address the bottleneck?

Disable all low-severity alerts

Implement a triage process that categorizes alerts by severity and assigns them to appropriate analysts

Increase the number of alerts forwarded to the SIEM

Replace the ticketing system with a new one without changing workflows

A SOC is at a mature stage with a fully deployed SIEM, EDR, and threat intelligence integration. The team wants to further improve by reducing manual effort in incident response. Which capability should be added next?

Additional threat intelligence feeds

Security orchestration, automation, and response (SOAR) platform

Additional SIEM correlation rules

EC-CouncilSOC Essentials

Domain 4Objective 2

SOC Architecture and Infrastructure SCE Practice Questions (Page 6)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 26–30

26application · medium
A SOC team needs to track the status of security incidents from detection to closure, ensuring that no incident is forgotten and that all actions are documented. Which tool is specifically designed for this purpose?
Select an answer first
27expert · hard
A SOC is integrating multiple threat intelligence feeds into its SIEM. The team notices that some feeds are causing a high number of false positives because they contain outdated or low-confidence indicators. The SOC wants to maintain high detection fidelity while still benefiting from external intelligence. Which approach is the most balanced?
Select an answer first
28expert · hard
During an incident, a SOC analyst discovers that the containment action taken earlier was ineffective because the attacker had already established persistence on multiple hosts. The team needs to revise its approach. Which action best addresses the situation?
Select an answer first
29application · medium
A SOC is experiencing a high rate of alerts that are not being investigated promptly because analysts are overwhelmed. The manager wants to improve the efficiency of the SOC by better integrating people, processes, and technology. Which change would BEST address the bottleneck?
Select an answer first
30expert · hard
A SOC is at a mature stage with a fully deployed SIEM, EDR, and threat intelligence integration. The team wants to further improve by reducing manual effort in incident response. Which capability should be added next?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

SOC Architecture and Infrastructure SCE Practice Questions (Page 6)

Questions 26–30

A SOC team needs to track the status of security incidents from detection to closure, ensuring that no incident is forgotten and that all actions are documented. Which tool is specifically designed for this purpose?

During an incident, a SOC analyst discovers that the containment action taken earlier was ineffective because the attacker had already established persistence on multiple hosts. The team needs to revise its approach. Which action best addresses the situation?

A SOC is experiencing a high rate of alerts that are not being investigated promptly because analysts are overwhelmed. The manager wants to improve the efficiency of the SOC by better integrating people, processes, and technology. Which change would BEST address the bottleneck?

A SOC is at a mature stage with a fully deployed SIEM, EDR, and threat intelligence integration. The team wants to further improve by reducing manual effort in incident response. Which capability should be added next?

Keep studying — SOC Components and Architecture