SOC KPIs, Metrics, and Maturity Models SCE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC manager wants to improve the team's detection capability. The team currently measures the number of alerts generated and the number of incidents confirmed. Which additional metric would provide the most insight into detection effectiveness?

   • ANumber of security tools deployed
   • BAverage cost per incident
   • CNumber of analysts on shift
   • DMean time to detect (MTTD) for confirmed incidents
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following best describes the typical structure of a SOC maturity model?

   • AA financial framework for calculating the return on investment of a SOC.
   • BA list of mandatory security tools that must be purchased to achieve maturity.
   • CA binary classification: either a SOC is mature or it is not.
   • DA set of discrete levels, each representing a stage of capability, with defined characteristics and practices for each level.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC manager needs to report to the board on the SOC's effectiveness. The board wants to know if the SOC is meeting its goal of containing incidents within 30 minutes. Which KPI should the manager report?

   • ANumber of security incidents per month
   • BPercentage of incidents contained within 30 minutes
   • CAverage time to escalate alerts
   • DTotal number of alerts processed
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A SOC manager is reviewing the following metrics: MTTD = 1 hour, MTTR = 2 hours, MTTC = 4 hours, and false positive rate = 20%. The manager wants to reduce the overall impact of incidents. Which metric should be the primary focus?

   • AMean time to contain (MTTC)
   • BMean time to respond (MTTR)
   • CFalse positive rate
   • DMean time to detect (MTTD)
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of a SOC maturity model?

   • ATo provide a structured framework for assessing the current capabilities of a SOC and guiding its evolution toward higher levels of effectiveness.
   • BTo replace the need for SOC metrics and KPIs.
   • CTo certify that a SOC meets all regulatory compliance requirements.
   • DTo guarantee that a SOC will never experience a security breach.
   Reveal Solution Discussion Select an answer first