SOC KPIs, Metrics, and Maturity Models SCE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC manager is using a maturity model to plan improvements but faces budget constraints. The assessment shows that the SOC is at the 'defined' level with strong processes but lacks automated alert triage, leading to high analyst workload. The manager must choose between investing in automation or additional training. Which decision best aligns with the maturity model's guidance?

   • AInvest equally in both, because maturity models require balanced improvement across all dimensions
   • BInvest in automation first, because it addresses the technology gap that is limiting the SOC's ability to scale to the 'managed' level
   • CInvest in training first, because people are always the most critical asset in a SOC
   • DDefer both investments until the SOC reaches the 'optimizing' level
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A SOC manager is defining KPIs for the team. The team has a goal to 'improve detection capabilities'. The manager proposes three KPIs: MTTD, false positive rate, and number of alerts per day. Which of these KPIs are appropriate for measuring the goal?

   • AFalse positive rate and number of alerts per day
   • BMTTD and false positive rate
   • CMTTD and number of alerts per day
   • DAll three KPIs are appropriate
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC manager is asked to justify the purchase of a new SOAR platform. The manager wants to use a maturity model to show that the SOC currently relies on manual processes and lacks automation. Which maturity model level best describes this state?

   • ALevel 3: Defined/Standardized
   • BLevel 4: Quantitatively Managed
   • CLevel 2: Managed/Repeatable
   • DLevel 1: Initial/Ad hoc
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A SOC manager is comparing two maturity models: one that focuses on process maturity (e.g., CMMI-like) and one that focuses on capability maturity (e.g., SOC-CMM). The SOC has strong processes but inconsistent execution across shifts. Which model would be more useful for identifying the root cause of the inconsistency?

   • ANeither model, since maturity models cannot diagnose execution inconsistencies
   • BA capability maturity model that assesses people, process, and technology dimensions
   • CA process maturity model that focuses only on process definitions
   • DEither model, since both would identify the same root cause
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC has well-documented procedures, but each analyst follows them differently, and there is no central tool to enforce consistent execution. Using a maturity model, which capability area is most likely to be rated low?

   • AStaff training and certification
   • BIncident response speed
   • CProcess consistency and tool integration
   • DThreat intelligence sharing
   Reveal Solution Discussion Select an answer first