SOC KPIs, Metrics, and Maturity Models SCE Practice Questions (Page 9)

Questions 41–42

1. 41foundation · easy

   A SOC manager notices that the Mean Time to Detect (MTTD) has increased significantly over the past quarter. Which of the following is the most appropriate use of this KPI?

   • ATo identify a potential decline in detection efficiency and investigate root causes such as alert fatigue or tool misconfiguration.
   • BTo immediately terminate the SIEM vendor contract.
   • CTo ignore the trend because MTTD is not a meaningful KPI.
   • DTo use the increase as a reason to reduce the number of security analysts.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard · select all that apply

   A SOC manager is defining KPIs for the SOC. The manager wants to include KPIs that measure both efficiency and effectiveness. Select all that apply: which of the following are valid KPIs?

   • ANumber of alerts processed per day
   • BFalse positive rate with a target of less than 10%
   • CPercentage of incidents contained within 1 hour
   • DMean time to respond (MTTR) with a target of under 30 minutes
   • ETotal number of security incidents per month
   Check answers Discussion Select an answer first