SOC KPIs, Metrics, and Maturity Models SCE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC tracks the number of security incidents handled per week and the percentage of alerts that are false positives. The manager wants to present a single measure that reflects the overall quality of the detection and triage process. Which approach best represents a KPI rather than a raw metric?

   • AList the total number of alerts generated by each detection tool
   • BTrack the average time analysts spend on each alert
   • CCompare the false positive percentage against a target of less than 15%
   • DReport the raw count of incidents handled per week
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a common SOC metric that is NOT typically considered a KPI?

   • AMean Time to Respond (MTTR)
   • BFalse positive rate
   • CNumber of alerts generated per day
   • DMean Time to Detect (MTTD)
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC is evaluating its maturity using a model that defines five levels. The SOC has standardized incident response procedures that are consistently followed, and it collects metrics on response times. However, the SOC does not use the metrics to optimize processes. Which maturity level does this SOC most likely represent?

   • AManaged
   • BDefined
   • CRepeatable
   • DOptimizing
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC manager is using a maturity model to plan improvements. The SOC has a mature detection process but lacks a formal incident response plan. The manager has limited budget and must choose between hiring more analysts and developing a formal incident response plan. Which choice best aligns with the maturity model's guidance?

   • AOutsource incident response to a third party
   • BPurchase a new SIEM to improve detection
   • CHire more analysts to handle the current workload
   • DDevelop a formal incident response plan first
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC manager is reviewing monthly metrics and notices that the false positive rate has decreased from 30% to 10%, but the mean time to detect (MTTD) has increased from 1 hour to 3 hours. What is the most likely explanation for this trade-off?

   • AThe SOC hired more analysts, which reduced false positives but slowed detection due to more coordination
   • BDetection rules were tuned to be more specific, reducing false positives but also increasing detection time for true positives
   • CThe SOC improved its threat intelligence, which reduced false positives but increased detection time due to more data to analyze
   • DThe SOC reduced the number of alerts monitored, which lowered false positives but also delayed detection
   Reveal Solution Discussion Select an answer first