SOC People, Process, and Technologies SCE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC is considering adding a new technology to improve detection of advanced threats that evade signature-based tools. The team has a limited budget and wants to minimize operational overhead. Which technology would best meet this need?

   • AAdd more signature-based IDS rules to the existing IPS.
   • BImplement a honeypot to attract attackers.
   • CDeploy a network traffic analysis (NTA) tool that uses behavioral analytics.
   • DIncrease the frequency of vulnerability scans.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A SOC manager is evaluating the SOC's overall effectiveness. The manager notices that the team is slow to respond to incidents because analysts are spending too much time on manual data collection and enrichment. The manager wants to improve response times without sacrificing accuracy. Which approach best addresses this challenge?

   • ARequire analysts to manually collect and enrich data for every alert to ensure accuracy.
   • BHire more analysts to handle the manual data collection and enrichment workload.
   • CImplement SOAR playbooks that automate data collection and enrichment, and provide training to analysts on how to use the playbooks effectively.
   • DReduce the number of alerts that are investigated by increasing the severity threshold for all alerts.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC team is evaluating tools to reduce the time analysts spend on repetitive, low-level alert investigations. The team wants to automate enrichment and simple response actions, but they also need to retain human decision-making for complex incidents. Which approach best meets these requirements?

   • AConfigure the SIEM to automatically suppress all alerts that match a known false-positive pattern and send all other alerts to the SOAR platform for automated resolution.
   • BReplace the SIEM with an EDR solution that can automatically quarantine endpoints and block indicators of compromise without analyst involvement.
   • CDeploy a SOAR platform that integrates with the SIEM to automate enrichment and run predefined response playbooks for low-risk alerts, while leaving high-risk alerts for manual analysis.
   • DAdd an IDS/IPS inline that automatically blocks all traffic matching known attack signatures, reducing the number of alerts analysts need to review.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A SOC is experiencing a high rate of alert fatigue. The team is missing critical alerts because they are overwhelmed by the volume of low-fidelity alerts. The SOC manager wants to reduce the number of false positives without missing genuine threats. The team has access to a SIEM, SOAR, and EDR. Which combination of actions would be most effective?

   • ARequire analysts to manually review every alert and document a reason for closing it, ensuring no alert is missed.
   • BTune the SIEM detection rules to reduce false positives, implement SOAR playbooks to automatically handle routine low-risk alerts, and use EDR telemetry to enrich alerts with endpoint context.
   • CUse the SOAR platform to automatically close all alerts that have been open for more than 24 hours.
   • DIncrease the severity threshold for all alerts so only the most critical alerts are generated, and disable all low-severity rules.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC is understaffed during the night shift. The manager wants to ensure that critical alerts are still addressed promptly even with limited staff. Which approach best balances the need for coverage with the available resources?

   • AConfigure the SIEM to automatically resolve all alerts that are not marked as critical, so analysts only see critical alerts.
   • BImplement an on-call rotation for senior analysts who can be reached for escalation, while junior analysts monitor the SIEM and perform initial triage during the night shift.
   • CReduce the number of alerts generated during the night shift by disabling non-critical detection rules.
   • DRequire all night-shift alerts to be handled by the SOC manager, who will be on call 24/7.
   Reveal Solution Discussion Select an answer first