SOC Team Roles and Responsibilities SCE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC is implementing a new shift handover process. The SOC manager wants to ensure that the process is effective and that no critical information is lost. Which approach is most likely to achieve this goal?

   • AHold a brief meeting between the outgoing and incoming shift leads without documentation.
   • BHave the outgoing shift send an email summary to the incoming shift.
   • CRecord the outgoing shift's verbal summary and store it in a shared drive.
   • DRequire the outgoing shift to complete a structured handover form that includes open incidents, ongoing investigations, and key decisions, and review it with the incoming shift.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC shift is ending, and the outgoing analyst has been investigating a phishing campaign. The analyst has identified several indicators of compromise (IOCs) but has not yet completed the analysis. What should the analyst include in the handover?

   • AA note to close the ticket as unresolved
   • BA request for Tier 3 to take over the investigation
   • COnly the IOCs, since the analysis is incomplete
   • DA summary of the investigation, IOCs, and next steps
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A SOC manager is evaluating the team's performance. The manager notices that Tier 2 analysts are spending too much time on low-level alerts that should be handled by Tier 1. What is the most effective way to address this?

   • AImplement a stricter escalation policy and train Tier 1 analysts
   • BIncrease the number of alerts sent to Tier 2
   • CMove Tier 2 analysts to Tier 1 roles
   • DHave Tier 2 analysts work faster
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A SOC has a high rate of alerts during shift changes. The outgoing analyst is often rushed and provides incomplete handovers. What is the most effective way to improve handover quality?

   • AHave the outgoing analyst document handover after leaving
   • BReduce the number of alerts during shift changes
   • CRequire a 30-minute overlap between shifts for handover
   • DAssign handover to the SOC manager
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A SOC is responding to a multi-stage attack. The incident responder has contained the initial compromise, but the threat hunter has identified additional compromised systems that were not previously known. The forensic analyst is preparing to collect evidence from these systems. The shift is ending, and the incoming shift needs to continue the investigation. What is the most important information to include in the handover?

   • AThe contact information for the external stakeholders involved.
   • BThe names of the threat hunter and forensic analyst who worked on the incident.
   • CThe number of alerts generated during the shift.
   • DThe status of the containment, the list of newly identified compromised systems, and the evidence collection plan.
   Reveal Solution Discussion Select an answer first