SOC KPIs, Metrics, and Maturity Models SCE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A SOC manager uses a maturity model to assess their SOC and finds that incident response processes are performed in an ad-hoc manner with no formal documentation. According to typical maturity levels, which level best describes this state?

   • ARepeatable level
   • BManaged or defined level
   • CInitial or ad-hoc level
   • DOptimized level
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC manager wants to use a maturity model to plan improvements. The SOC currently has no formal incident response plan, but the team is highly skilled and often resolves issues effectively. Which step should the manager take first according to the maturity model?

   • ADocument a formal incident response plan
   • BIncrease staff training
   • CPurchase a new SIEM tool
   • DMeasure mean time to respond (MTTR)
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC team is overwhelmed by a high volume of alerts. The manager wants to reduce the workload without missing real incidents. Which approach should the manager take?

   • ADisable all alerts that are not critical
   • BIncrease the number of alerts escalated to Tier 3
   • CReduce the number of analysts on shift
   • DTune detection rules to reduce false positives
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC manager is using a maturity model to assess the SOC and finds that the SOC is at the 'managed' level. The manager wants to advance to the 'optimizing' level but has limited budget. Which initiative would best align with the maturity model's guidance for moving from 'managed' to 'optimizing'?

   • AImplement a continuous improvement program that uses metrics to identify and implement process enhancements
   • BPurchase additional security tools to enhance detection capabilities
   • CIncrease the number of SOC analysts to reduce workload
   • DStandardize incident response procedures
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is an example of a SOC Key Performance Indicator (KPI)?

   • ATotal storage capacity of the SIEM
   • BMean Time to Detect (MTTD)
   • CNumber of firewall rules configured
   • DList of active security vendors
   Reveal Solution Discussion Select an answer first