SOC People, Process, and Technologies SCE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC is considering whether to invest in a SOAR platform. The team currently uses a SIEM and manual processes for incident response. The main concern is that the SOAR platform may be too complex to maintain. Which approach would best mitigate this concern?

   • ADeploy the SOAR platform with all available integrations enabled immediately.
   • BStart with a small set of automated playbooks for high-volume, low-complexity alerts and gradually expand.
   • CAvoid using SOAR and continue with manual processes.
   • DHire a dedicated team to manage the SOAR platform.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC has recently deployed a SIEM and EDR tools, but analysts are still missing critical alerts because they are overwhelmed by the volume of notifications. Which combination of actions would most effectively address this issue?

   • AHire more analysts to manually review every alert.
   • BTune the SIEM correlation rules and implement a triage process to prioritize alerts.
   • CReplace the SIEM with a SOAR platform.
   • DDisable all alerts that are not marked as critical.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During a shift, a SOC analyst observes a series of failed login attempts followed by a successful login from an unusual geographic location. The analyst checks the user's account and finds no other suspicious activity. According to a typical SOC workflow, what should the analyst do next?

   • AIgnore the alert because the successful login could be explained by the user traveling to that location.
   • BSend an email to the entire SOC team describing the alert and asking for opinions on whether it is suspicious.
   • CFollow the documented triage procedure to assess the risk, then escalate to the incident responder if the procedure indicates a potential account compromise.
   • DImmediately disable the user's account to prevent further unauthorized access, then notify the user's manager.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company wants to automate the initial triage of common alerts and orchestrate response actions across its security tools. Which technology should the SOC implement to achieve this goal?

   • ASIEM system
   • BSOAR platform
   • CIDS/IPS
   • DEDR solution
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC manager notices that the team is missing critical alerts because analysts are overwhelmed by a high volume of low-fidelity alerts. The manager wants to improve the team's ability to focus on genuine threats without adding more staff. Which approach best addresses this challenge?

   • ARequire analysts to manually review every alert and document a reason for closing each one, ensuring no alert is missed.
   • BTune the SIEM detection rules to reduce false positives and implement a SOAR playbook to automatically handle routine low-risk alerts, freeing analysts to focus on higher-fidelity alerts.
   • CIncrease the severity threshold for all alerts so only the most critical alerts are generated, reducing the volume.
   • DAssign the most experienced analysts to monitor the SIEM dashboard and have junior analysts handle all other tasks.
   Reveal Solution Discussion Select an answer first