SOC People, Process, and Technologies SCE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which SOC role is responsible for leading the response to a confirmed security incident, coordinating actions to contain and eradicate the threat, and ensuring proper documentation?

   • ASOC Analyst
   • BSOC Manager
   • CForensic Analyst
   • DIncident Responder
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Why is the integration of people, process, and technology considered essential for effective SOC operations?

   • APeople are the most important element, and processes and technology are optional enhancements.
   • BTechnology alone can fully automate incident response, making people and process unnecessary.
   • CProcesses are the most important element, and people and technology are only needed to support them.
   • DPeople provide the skills and judgment, processes provide the structure and consistency, and technology provides the tools and automation to execute efficiently.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A SOC team is responding to a ransomware incident. The team has identified the affected endpoints and wants to contain the spread. The incident responder wants to isolate the affected endpoints from the network, but the SOC manager is concerned about the impact on business operations. Which approach best balances containment with business continuity?

   • AIsolate the affected endpoints from the network, but first coordinate with the business to understand the impact and identify any critical systems that need to remain operational.
   • BDo not isolate the endpoints and instead monitor the situation to see if the ransomware spreads further.
   • CIsolate only the endpoints that are not critical to business operations, and leave critical endpoints connected to avoid disruption.
   • DIsolate all affected endpoints immediately without considering the business impact, to contain the spread as quickly as possible.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A SOC manager is designing the incident response workflow for a new SOC. The manager wants to ensure that the workflow is effective and that roles are clearly defined. The team includes junior analysts, senior analysts, an incident responder, and a SOC manager. Which workflow design best supports effective incident response?

   • AThe incident responder performs all tasks from triage through containment, with the SOC manager only providing oversight.
   • BJunior analysts perform initial triage, senior analysts investigate and contain incidents, the incident responder coordinates the response, and the SOC manager provides oversight and communicates with executive leadership.
   • CSenior analysts perform initial triage, junior analysts investigate and contain incidents, the SOC manager coordinates the response, and the incident responder communicates with executive leadership.
   • DAll team members share the same responsibilities and rotate through triage, investigation, and containment tasks.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A SOC team is investigating a potential malware outbreak on several endpoints. The team wants to quickly identify which other endpoints may be affected and isolate them from the network. Which combination of technologies would best support this effort?

   • AUse the EDR console to search for indicators of compromise across all endpoints and initiate isolation on affected machines, while using the SIEM to correlate network activity for additional affected systems.
   • BUse the firewall to block all outbound traffic from the affected endpoints and manually check each endpoint for signs of infection.
   • CUse the SIEM to search for indicators of compromise across all endpoints and initiate isolation on affected machines, while using the IDS to monitor network traffic.
   • DUse the IDS/IPS to block all traffic from the affected endpoints and rely on the SOAR platform to identify other affected systems.
   Reveal Solution Discussion Select an answer first