A SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst has verified the alert and determined that the infection is real. According to typical SOC procedures, what should the analyst do next?

Immediately disconnect the workstation from the network.

Contact the user and ask them to restart the workstation.

Escalate the incident to Tier 2 for deeper analysis and response.

Close the alert as a false positive.

A SOC team is investigating a breach that occurred several weeks ago. The team suspects the attacker is still present in the network. Which combination of roles is most appropriate to handle this situation?

Incident responders and threat hunters

Forensic analysts and Tier 1 analysts

Tier 1 analysts and the SOC manager

Threat hunters and the SOC manager

EC-CouncilSOC Essentials

Domain 3Objective 2

SOC Team Roles and Responsibilities SCE Practice Questions (Page 7)

Part of the Introduction to the Security Operations Center domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

5concepts

Questions 31–35

31application · medium
A SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst has verified the alert and determined that the infection is real. According to typical SOC procedures, what should the analyst do next?
Select an answer first
32foundation · easy
During a security incident, which SOC role typically acts as the primary point of contact for communicating with executive management and external stakeholders?
Select an answer first
33foundation · easy
In a typical SOC team structure, which role is responsible for overseeing the entire SOC operation, managing resources, and reporting to senior management?
Select an answer first
34application · medium
A SOC team is investigating a breach that occurred several weeks ago. The team suspects the attacker is still present in the network. Which combination of roles is most appropriate to handle this situation?
Select an answer first
35foundation · easy
Which SOC role is responsible for conducting in-depth analysis of escalated incidents, performing root cause analysis, and recommending remediation actions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

SOC Team Roles and Responsibilities SCE Practice Questions (Page 7)

Questions 31–35

A SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst has verified the alert and determined that the infection is real. According to typical SOC procedures, what should the analyst do next?

During a security incident, which SOC role typically acts as the primary point of contact for communicating with executive management and external stakeholders?

In a typical SOC team structure, which role is responsible for overseeing the entire SOC operation, managing resources, and reporting to senior management?

A SOC team is investigating a breach that occurred several weeks ago. The team suspects the attacker is still present in the network. Which combination of roles is most appropriate to handle this situation?

Which SOC role is responsible for conducting in-depth analysis of escalated incidents, performing root cause analysis, and recommending remediation actions?

Keep studying — Introduction to the Security Operations Center