SOC People, Process, and Technologies SCE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC manager is planning the technology stack for a new SOC. The manager wants to ensure that the SOC can detect and respond to threats across the network, endpoints, and cloud environments. The budget is limited, and the manager needs to prioritize investments. Which technology should the manager prioritize?

   • AAn EDR solution that can provide deep visibility into endpoint activity and enable rapid response.
   • BA SOAR platform that can automate response actions and orchestrate workflows.
   • CAn IDS/IPS that can monitor network traffic and block malicious activity.
   • DA SIEM that can aggregate logs from network devices, endpoints, and cloud services, providing a central view for detection and investigation.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SOC manager is reviewing the team's incident response process after a recent security incident. The manager notices that the team was slow to identify the root cause of the incident because analysts were working in silos and not sharing information effectively. The manager wants to improve collaboration and information sharing during incidents. Which approach best addresses this challenge?

   • AAssign each analyst a specific area of investigation and have them report only to the incident responder.
   • BUse the SIEM to automatically share all alerts with all team members, without any additional process.
   • CImplement a collaboration platform (such as a chat tool) and define a process for sharing findings and updates during incidents, ensuring all team members have access to the same information.
   • DRequire each analyst to document their findings in a personal notebook and share it with the SOC manager at the end of the incident.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC manager is planning the implementation of a new SOAR platform. The team has limited scripting experience, and the manager wants to ensure that the platform is adopted successfully. The manager also wants to reduce the time analysts spend on repetitive tasks. Which approach best balances the need for automation with the team's current skill set?

   • AHire external consultants to build all playbooks and hand them over to the team after completion.
   • BStart with out-of-the-box playbooks for common use cases and provide training to analysts on how to customize them, gradually building in-house expertise.
   • CRequire all analysts to complete advanced scripting training before the SOAR platform is deployed.
   • DDeploy the SOAR platform with no playbooks and allow analysts to create them from scratch as needed.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which SOC process is specifically designed to ensure that an incident is handled according to its severity and that the appropriate personnel are engaged?

   • AContainment
   • BEscalation
   • CMonitoring
   • DTriage
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In a SOC workflow, what is the primary purpose of the triage phase?

   • ATo automatically remediate all confirmed threats without human intervention
   • BTo permanently close all alerts that are not immediately critical
   • CTo determine the priority of each alert and decide whether it requires further investigation
   • DTo document the final root cause of every incident
   Reveal Solution Discussion Select an answer first