SOC Team Roles and Responsibilities SCE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a key element of an effective SOC shift handover?

   • AWaiting for the next shift to arrive before starting any new investigations
   • BDeleting all logs from the previous shift to save storage
   • CSharing only the most critical alerts, ignoring minor ones
   • DDocumenting the status of all open incidents and any actions taken
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC is responding to a data breach that involves personally identifiable information (PII). The SOC manager must coordinate with legal, IT, and public relations teams. The legal team requires a detailed timeline of the breach, while IT needs to know which systems to isolate. The SOC manager is the only person authorized to communicate with external stakeholders. What is the most effective way for the SOC manager to ensure all parties receive the information they need?

   • AHold a single meeting with all stakeholders to discuss the breach.
   • BEstablish a communication plan that designates specific points of contact and provides regular status updates tailored to each stakeholder.
   • CDelegate communication to the Tier 2 analysts handling the incident.
   • DProvide all stakeholders with full access to the SOC's incident management platform.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   During a major incident, the incident responder has contained the threat, but the forensic analyst needs to preserve evidence for potential legal action. The forensic analyst is concerned that the incident responder's actions may have altered critical evidence. What is the most appropriate way to address this concern?

   • ADocument all actions taken during the incident response and ensure that evidence is collected and preserved according to forensic best practices.
   • BIgnore the concern because the incident responder's actions are necessary for containment.
   • CHave the incident responder redo the containment to ensure evidence is preserved.
   • DHave the forensic analyst take over the incident response from that point forward.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC analyst at Tier 1 notices repeated failed login attempts against a finance application and escalates the alert to Tier 2. The Tier 2 analyst confirms the activity is malicious and begins containment. The shift is ending in 30 minutes. What is the most appropriate action for the Tier 2 analyst to take before leaving?

   • AWait until the next shift arrives and personally walk them through the incident before leaving.
   • BEscalate the incident to Tier 3 and leave without further documentation.
   • CClose the incident ticket as resolved since containment has been initiated.
   • DDocument the current status, actions taken, and next steps in the incident ticket and provide a detailed handover to the incoming shift.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC is restructuring to improve efficiency. Currently, all analysts perform the same duties. The SOC manager wants to implement a tiered structure. Which change best reflects a typical SOC hierarchy?

   • AEliminate tiers and have the SOC manager review every alert
   • BCreate Tier 1 for monitoring and triage, Tier 2 for investigation, and Tier 3 for advanced analysis
   • CHave Tier 3 analysts handle all alerts directly to reduce workload
   • DAssign all analysts to Tier 1 and rotate them through Tier 2 weekly
   Reveal Solution Discussion Select an answer first