SOC Team Roles and Responsibilities SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC team is being restructured to improve efficiency. The team currently has a SOC manager, two team leads, and several analysts. The analysts are all performing the same duties, which has led to confusion about who is responsible for escalated incidents. What change would best clarify roles and responsibilities?

   • AAssign analysts to specific tiers (Tier 1, Tier 2, Tier 3) with defined responsibilities and escalation paths.
   • BIncrease the number of team leads to match the number of analysts.
   • CRotate analysts through different duties on a weekly basis.
   • DHave all analysts report directly to the SOC manager without team leads.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A SOC has identified a critical vulnerability in a third-party application used by the organization. The SOC manager needs to coordinate with the vendor to obtain a patch, but the vendor is not responding to requests. The vulnerability is actively being exploited in the wild. What is the most appropriate course of action for the SOC manager?

   • AWait for the vendor to respond before taking any action.
   • BDisable the third-party application until the vendor provides a patch.
   • CHave the Tier 1 analysts monitor the application more closely.
   • DImplement temporary mitigations, such as network segmentation or access controls, while continuing to escalate the issue with the vendor.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC team identifies a critical vulnerability in a customer-facing web application. The SOC manager needs to communicate the risk and recommended mitigation to the executive team. Which communication approach is most appropriate?

   • APresent a high-level summary of the risk, potential business impact, and recommended actions
   • BDiscuss the vulnerability only with the IT team to avoid alarming executives
   • CWait until the vulnerability is exploited before informing executives
   • DSend the full technical vulnerability report to all executives
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of a shift handover procedure in a SOC?

   • ATo ensure that ongoing incidents and critical information are communicated to the incoming shift
   • BTo provide a break for analysts to rest and recharge
   • CTo allow the outgoing shift to leave early if no incidents occurred
   • DTo review the performance of individual analysts
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC team is responding to a ransomware incident. The incident response team needs to isolate affected systems, but the IT team is concerned about business disruption. What is the best course of action?

   • AAsk Tier 3 to make the decision
   • BWait for management to decide before isolating
   • CCollaborate with IT to balance containment and business impact
   • DIsolate the systems immediately without consulting IT
   Reveal Solution Discussion Select an answer first