SOC Architecture and Infrastructure SCE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC team is evaluating tools to improve incident handling. They currently use a SIEM for alerting and email for communication. The team wants to streamline the incident response process and ensure proper tracking. Which tool addition would be most beneficial?

   • AA second SIEM for redundancy
   • BA network packet capture tool
   • CA ticketing system integrated with the SIEM
   • DA vulnerability management platform
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   During which phase of the incident response workflow does the SOC focus on removing the root cause of an incident from affected systems?

   • ARecovery
   • BContainment
   • CEradication
   • DDetection
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A newly formed SOC relies on manual log reviews and has no centralized monitoring. The team wants to evolve to a more mature state. Which first step best aligns with the SOC maturity model?

   • ADeploy a SIEM to centralize log collection and basic alerting.
   • BOutsource all monitoring to a third-party provider.
   • CIncrease the number of analysts without changing processes or tools.
   • DImplement advanced threat hunting and automated response immediately.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC analyst is investigating a potential breach and wants to find all events related to a specific user account across multiple systems. Which SIEM capability is most directly useful for this task?

   • AThreat intelligence feed management
   • BNetwork packet capture
   • CAutomated patch management
   • DSearch and query functionality across normalized log data
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A SOC manager is evaluating the team's performance and notices that MTTD has decreased but MTTR has increased. The team is now detecting incidents faster but taking longer to resolve them. Which combination of changes would MOST likely improve MTTR without sacrificing detection quality?

   • AReduce the number of alerts forwarded to the SIEM
   • BIncrease the number of analysts on the team
   • CImplement automated playbooks for common incident types and provide additional training for analysts
   • DDisable all low-severity alerts to focus on high-severity ones
   Reveal Solution Discussion Select an answer first