SOC KPIs, Metrics, and Maturity Models SCE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A SOC reports a high number of alerts per day, but the false positive rate is also high. Which of the following is the most appropriate conclusion from these metrics?

   • AThe SOC should immediately disable all detection rules to reduce false positives.
   • BThe SOC is performing well because the high alert volume indicates thorough monitoring.
   • CThe SOC is detecting many potential threats, and the high false positive rate is acceptable.
   • DThe SOC's detection rules may be too broad or misconfigured, leading to excessive noise and inefficient use of analyst resources.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC director is preparing a quarterly report for executive leadership. The report must show whether the SOC is meeting its goal of containing high-severity incidents within 30 minutes of detection. Which KPI should be highlighted?

   • AMean time to contain (MTTC) for high-severity incidents
   • BTotal number of high-severity incidents detected
   • CPercentage of alerts escalated within 15 minutes
   • DNumber of security tools deployed
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary difference between a KPI and a metric in a SOC context?

   • AKPIs are tied to strategic objectives, while metrics are raw measurements that may or may not be tied to objectives.
   • BKPIs are always quantitative, while metrics are always qualitative.
   • CKPIs are used for reporting to management, while metrics are used only for technical troubleshooting.
   • DKPIs are calculated monthly, while metrics are calculated in real time.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SOC analyst notices that the number of alerts has doubled, but the number of confirmed incidents has stayed the same. The analyst suspects the increase is due to a new detection rule. Which metric would best confirm this suspicion?

   • AMean time to respond (MTTR)
   • BMean time to detect (MTTD)
   • CFalse positive rate
   • DNumber of escalated alerts
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A SOC manager is using a maturity model to assess the SOC. The SOC has a well-defined incident response plan, but the plan is not consistently followed because analysts lack training. The manager must decide whether to invest in training or in a new automation tool. Which decision best addresses the root cause of the maturity gap?

   • AHire more experienced analysts
   • BInvest in training to ensure analysts can follow the plan
   • CInvest in automation to enforce the plan
   • DRevise the plan to be simpler
   Reveal Solution Discussion Select an answer first