SOC Team Roles and Responsibilities SCE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC manager is reviewing the team's performance and notices that Tier 1 analysts are frequently escalating alerts that Tier 2 analysts quickly close as false positives. What is the most likely cause of this issue?

   • ATier 3 analysts are not involved in the process
   • BTier 1 analysts lack sufficient training on alert triage
   • CTier 2 analysts are too quick to close alerts
   • DThe SOC manager is not reviewing escalations
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of effective collaboration between SOC team members and the IT department?

   • ASOC analysts keep incident details confidential from IT to avoid panic
   • BSOC analysts share threat intelligence with IT to help patch vulnerable systems
   • CIT department blocks all external communication without SOC approval
   • DIT department replaces the SOC's monitoring tools without consulting the SOC
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC team is implementing a new shift handover procedure. The goal is to ensure that no critical information is lost between shifts. Which practice is most effective for achieving this goal?

   • AHolding a brief meeting between the outgoing and incoming shift leads to discuss any issues.
   • BRequiring the outgoing shift to document all open incidents, ongoing investigations, and key decisions in a shared handover document.
   • CHaving the outgoing shift send an email summary to the entire SOC team.
   • DRecording a verbal summary of the shift and storing it in a shared drive.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC analyst at Tier 1 notices repeated failed login attempts against a finance application and escalates the ticket to Tier 2. The Tier 2 analyst investigates, determines the attempts are from a known botnet, and recommends blocking the source IPs. The Tier 2 analyst then updates the ticket and closes it. Which action is missing in this workflow?

   • AHaving Tier 3 perform a full forensic analysis of the failed logins
   • BDocumenting the incident in the shift handover log for the next shift
   • CInforming the SOC manager before any action is taken
   • DCoordinating with the IT team to verify the block does not disrupt legitimate users
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A SOC team discovers a data breach that affects customer data. The legal team advises that the breach must be reported to regulators within 72 hours. The SOC manager needs to ensure this happens. What is the most important action?

   • ANotify the CEO immediately
   • BEstablish a clear communication plan with legal and management
   • CHave the Tier 1 analyst draft the regulatory report
   • DWait for the forensic analysis to be complete before reporting
   Reveal Solution Discussion Select an answer first