A SOC operates 24/7 with three shifts. During a shift change, the outgoing analyst verbally tells the incoming analyst about an ongoing incident. The incoming analyst later forgets key details and makes an error. What should the SOC implement to prevent this?

Use only email to communicate handover details

Require written handover documentation for every shift

Assign the incident to Tier 3 to avoid handover

Have the outgoing analyst stay until the incident is resolved

A SOC is experiencing a high volume of alerts, and Tier 1 analysts are overwhelmed. The SOC manager wants to improve efficiency by ensuring that alerts are properly triaged and escalated. What structural change would best address this issue?

Reduce the number of alerts by disabling less critical detection rules.

Implement a clear escalation policy that defines which alerts should be handled by each tier.

Hire more Tier 3 analysts to handle all alerts.

Have the SOC manager personally review every alert.

A SOC is understaffed, and the SOC manager must decide how to allocate limited resources. The team has one Tier 1 analyst, one Tier 2 analyst, and one Tier 3 analyst. A high-priority alert has just been escalated to Tier 2, but the Tier 2 analyst is already working on a complex incident. What is the most appropriate action for the SOC manager to take?

Have the Tier 2 analyst pause the complex incident to handle the high-priority alert.

Have the Tier 1 analyst handle the high-priority alert independently.

Escalate the high-priority alert to the SOC manager for handling.

Have the Tier 3 analyst assist with the high-priority alert while the Tier 2 analyst continues the complex incident.

A Tier 2 analyst is investigating a malware infection on a server. The analyst needs to determine the malware's behavior and identify the attack vector. Which action is most appropriate for this role?

Rebuild the server immediately to contain the infection

Perform in-depth malware reverse engineering

Escalate the incident to the SOC manager for a decision

Analyze logs and network traffic to identify the infection source

EC-CouncilSOC Essentials

Domain 3Objective 2

SOC Team Roles and Responsibilities SCE Practice Questions (Page 6)

Part of the Introduction to the Security Operations Center domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

5concepts

Questions 26–30

26application · medium
A SOC operates 24/7 with three shifts. During a shift change, the outgoing analyst verbally tells the incoming analyst about an ongoing incident. The incoming analyst later forgets key details and makes an error. What should the SOC implement to prevent this?
Select an answer first
27foundation · easy
Which SOC role is responsible for collecting and analyzing digital evidence from compromised systems to support legal proceedings?
Select an answer first
28application · medium
A SOC is experiencing a high volume of alerts, and Tier 1 analysts are overwhelmed. The SOC manager wants to improve efficiency by ensuring that alerts are properly triaged and escalated. What structural change would best address this issue?
Select an answer first
29expert · hard
A SOC is understaffed, and the SOC manager must decide how to allocate limited resources. The team has one Tier 1 analyst, one Tier 2 analyst, and one Tier 3 analyst. A high-priority alert has just been escalated to Tier 2, but the Tier 2 analyst is already working on a complex incident. What is the most appropriate action for the SOC manager to take?
Select an answer first
30application · medium
A Tier 2 analyst is investigating a malware infection on a server. The analyst needs to determine the malware's behavior and identify the attack vector. Which action is most appropriate for this role?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

SOC Team Roles and Responsibilities SCE Practice Questions (Page 6)

Questions 26–30

A SOC operates 24/7 with three shifts. During a shift change, the outgoing analyst verbally tells the incoming analyst about an ongoing incident. The incoming analyst later forgets key details and makes an error. What should the SOC implement to prevent this?

Which SOC role is responsible for collecting and analyzing digital evidence from compromised systems to support legal proceedings?

A SOC is experiencing a high volume of alerts, and Tier 1 analysts are overwhelmed. The SOC manager wants to improve efficiency by ensuring that alerts are properly triaged and escalated. What structural change would best address this issue?

A Tier 2 analyst is investigating a malware infection on a server. The analyst needs to determine the malware's behavior and identify the attack vector. Which action is most appropriate for this role?

Keep studying — Introduction to the Security Operations Center