SOC Team Roles and Responsibilities SCE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC operates with three shifts. During a shift handover, the outgoing Tier 2 analyst provides a detailed verbal briefing to the incoming Tier 2 analyst about an ongoing incident. However, the incoming analyst later finds that the incident ticket lacks key details, such as the specific actions taken and the current containment status. What is the most likely cause of this issue?

   • AThe incoming analyst did not ask enough questions during the briefing.
   • BThe handover relied on verbal communication instead of a documented handover log.
   • CThe SOC manager should have been involved in the handover.
   • DThe incident was too complex for a Tier 2 analyst to handle.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SOC has identified a sophisticated attack that evaded existing detection controls. The team suspects the attacker is still present and may have compromised multiple systems. The SOC manager needs to determine the full scope of the attack and identify any indicators of compromise that can be used to detect similar activity in the future. Which combination of roles is best suited to accomplish this?

   • AForensic analyst and SOC manager
   • BIncident responder and SOC manager
   • CThreat hunter and forensic analyst
   • DTier 1 analyst and Tier 2 analyst
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   During a major incident, the incident response team is overwhelmed with tasks. The forensic analyst is asked to help with containment, but this delays the forensic analysis. What is the best way to handle this conflict?

   • AHave the forensic analyst focus on containment and defer forensics
   • BPrioritize forensic analysis and delay containment
   • CAssign containment tasks to other team members and let the forensic analyst preserve evidence
   • DAsk the SOC manager to make the decision
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC shift is ending. The outgoing Tier 1 analyst has an open ticket about a suspicious PowerShell command on a workstation. The analyst has not yet determined if it is malicious. What should the analyst do during the handover?

   • AClose the ticket as a false positive to reduce the queue
   • BWait until the next shift arrives to discuss the ticket in person
   • CProvide a detailed summary of actions taken and remaining questions to the incoming analyst
   • DEscalate the ticket to Tier 3 immediately before leaving
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC team is responding to a critical incident. The incident response team is working with the IT team to contain the threat. The SOC manager wants to ensure that communication with external stakeholders is handled properly. What is the best approach?

   • AHave the SOC manager be the single point of contact for external stakeholders
   • BLet each team member communicate directly with external stakeholders
   • CHave the Tier 1 analyst communicate with external stakeholders
   • DAvoid communicating with external stakeholders until the incident is resolved
   Reveal Solution Discussion Select an answer first