SOC Architecture and Infrastructure SCE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A SOC needs to collect logs from cloud services, on-premises servers, and network devices. Which approach ensures consistent and reliable data ingestion into the SIEM?

   • AStore logs in a central file share and point the SIEM to read them periodically.
   • BHave administrators manually export logs and upload them to the SIEM daily.
   • CUse log forwarders or agents on each source to send data to the SIEM in a standardized format.
   • DConfigure the SIEM to directly query each source's database for logs.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A mid-sized company is building a SOC and wants to collect security-relevant data from its network, endpoints, and cloud services. The team needs a centralized platform that can normalize diverse log formats, correlate events across sources, and generate alerts for the analysts. Which component should be the core of this architecture?

   • AA ticketing system
   • BAn EDR solution
   • CA SIEM platform
   • DA network TAP
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A SOC integrates threat intelligence feeds into its SIEM, but analysts are overwhelmed by alerts matching low-confidence indicators. The team wants to reduce noise while still detecting high-confidence threats. Which approach is most effective?

   • AApply confidence scoring to threat intelligence and adjust alerting thresholds accordingly.
   • BRemove all low-confidence indicators from the threat intelligence feeds.
   • CIncrease the frequency of threat intelligence updates.
   • DDisable all alerts that match threat intelligence indicators.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What does the metric 'Mean Time to Detect (MTTD)' measure in a SOC?

   • AThe number of alerts generated per day
   • BThe total time spent on post-incident recovery
   • CThe average time between the occurrence of an incident and its detection
   • DThe average time taken to respond to and contain an incident
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A SOC wants to improve detection of known malicious indicators by automatically enriching alerts with external threat intelligence. Which integration approach is most effective?

   • AHave analysts manually check threat intelligence websites when investigating alerts.
   • BConfigure the SIEM to query threat intelligence feeds and enrich alerts with indicator matches.
   • CStore threat intelligence reports in a shared drive for analysts to read.
   • DBlock all traffic from IP addresses listed in public threat feeds at the firewall.
   Reveal Solution Discussion Select an answer first