A SOC manager is reviewing the following metrics for the past month: 10,000 alerts, 1,000 escalated to Tier 2, 100 escalated to Tier 3, 50 confirmed incidents, and an average MTTR of 45 minutes. The manager wants to identify areas for improvement. Select all that apply: which conclusions are valid based on these metrics?

The mean time to respond is below the industry average of 60 minutes

The escalation rate to Tier 2 is 10%

The alert reduction rate is 89%

The SOC is performing well because the alert reduction rate is high

A SOC manager is planning improvements based on a maturity model assessment. The assessment shows that the SOC has strong technology but weak process documentation and inconsistent incident handling. Which improvement should be prioritized?

Purchase additional security tools

Formalize and standardize incident response procedures

Increase the number of SOC analysts

Reduce the number of alerts monitored

A SOC team has been tracking the number of alerts generated per day, the number of incidents confirmed, and the average time to respond. The team wants to identify whether their detection rules are producing too many false positives. Which metric should they focus on?

False positive rate (percentage of alerts that are not real incidents)

EC-CouncilSOC Essentials

Domain 3Objective 3

SOC KPIs, Metrics, and Maturity Models SCE Practice Questions (Page 3)

Part of the Introduction to the Security Operations Center domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

5concepts

Questions 11–15

11expert · hard · select all that apply
A SOC manager is reviewing the following metrics for the past month: 10,000 alerts, 1,000 escalated to Tier 2, 100 escalated to Tier 3, 50 confirmed incidents, and an average MTTR of 45 minutes. The manager wants to identify areas for improvement. Select all that apply: which conclusions are valid based on these metrics?
Select an answer first
12application · medium
A SOC manager is planning improvements based on a maturity model assessment. The assessment shows that the SOC has strong technology but weak process documentation and inconsistent incident handling. Which improvement should be prioritized?
Select an answer first
13application · medium
A SOC team wants to measure the effectiveness of its threat detection rules. They currently track the total number of alerts and the number of confirmed incidents. Which KPI would best indicate whether the rules are generating too many false positives?
Select an answer first
14application · medium
A SOC team has been tracking the number of alerts generated per day, the number of incidents confirmed, and the average time to respond. The team wants to identify whether their detection rules are producing too many false positives. Which metric should they focus on?
Select an answer first
15application · medium
A SOC team is evaluating its performance and finds that the mean time to detect (MTTD) is 2 hours, but the mean time to respond (MTTR) is 4 hours. The team wants to reduce the overall impact of incidents. Which metric should they focus on improving?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

SOC KPIs, Metrics, and Maturity Models SCE Practice Questions (Page 3)

Questions 11–15

A SOC manager is planning improvements based on a maturity model assessment. The assessment shows that the SOC has strong technology but weak process documentation and inconsistent incident handling. Which improvement should be prioritized?

A SOC team wants to measure the effectiveness of its threat detection rules. They currently track the total number of alerts and the number of confirmed incidents. Which KPI would best indicate whether the rules are generating too many false positives?

A SOC team has been tracking the number of alerts generated per day, the number of incidents confirmed, and the average time to respond. The team wants to identify whether their detection rules are producing too many false positives. Which metric should they focus on?

A SOC team is evaluating its performance and finds that the mean time to detect (MTTD) is 2 hours, but the mean time to respond (MTTR) is 4 hours. The team wants to reduce the overall impact of incidents. Which metric should they focus on improving?

Keep studying — Introduction to the Security Operations Center