SOC People, Process, and Technologies SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC manager is reviewing the incident response workflow after a recent malware outbreak. The team noticed that critical alerts were not escalated quickly enough because analysts were unsure who to contact. Which process improvement should the manager implement?

   • ARequire analysts to resolve all alerts without escalation.
   • BDefine and document a clear escalation matrix with contact information and response time targets.
   • CIncrease the number of SOC analysts on each shift.
   • DDeploy additional EDR tools to detect malware faster.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In a Security Operations Center (SOC), which role is primarily responsible for the day-to-day monitoring of security alerts and initial investigation of potential incidents?

   • ASOC Manager
   • BIncident Responder
   • CSOC Analyst
   • DThreat Hunter
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   During a major security incident, the SOC manager needs to coordinate communication between technical teams and executive leadership. Which role is primarily responsible for this coordination?

   • ASOC analyst
   • BIT support technician
   • CIncident responder
   • DSOC manager
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC is defining its incident response workflow. The team wants to ensure that critical incidents are escalated quickly, but also wants to avoid overwhelming the incident response team with false alarms. Which process design best balances these goals?

   • AEscalate all alerts directly to the incident response team for immediate action.
   • BAutomate escalation based solely on the number of alerts received.
   • CImplement a two-tier triage process where Level 1 analysts filter and validate alerts before escalating to Level 2 responders.
   • DRequire all alerts to be validated by the SOC manager before escalation.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst is reviewing an alert that was automatically generated by the SIEM. The alert indicates a possible brute-force attack on a user account. The analyst checks the logs and sees that the attack originated from a single IP address and has been ongoing for the past hour. According to a typical SOC workflow, what should the analyst do?

   • AIgnore the alert because brute-force attacks are common and rarely successful.
   • BImmediately block the IP address at the firewall and close the alert.
   • CReset the user's password and notify the user to use a stronger password.
   • DFollow the triage procedure to assess the severity, then escalate to the incident responder if the procedure indicates a potential compromise.
   Reveal Solution Discussion Select an answer first