SOC Workflow, Processes, and Challenges SCE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization is setting up a new SOC and wants to define the steps from when a security alert is generated to when it is resolved. Which sequence best represents the typical SOC workflow?

   • AAlert generation → Escalation → Reporting → Closure
   • BTriage → Alert generation → Investigation → Reporting → Closure
   • CAlert generation → Triage → Investigation → Containment → Eradication → Recovery → Lessons learned
   • DMonitoring → Alert generation → Triage → Escalation → Closure
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC analyst receives an alert about a potential insider threat. The alert indicates that an employee is accessing sensitive files outside of normal working hours. The analyst checks the employee's access logs and finds that the employee has a valid reason for the access. What should the analyst do?

   • AMonitor the employee's activity more closely
   • BEscalate to the human resources department
   • CRevoke the employee's access immediately
   • DClose the alert as a false positive and document the reason
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC analyst receives an alert from the SIEM about a single workstation exhibiting repeated failed logins followed by a successful login at 3:00 AM. The analyst checks the user's recent activity and finds the user is on vacation. According to a typical SOC workflow, what should the analyst do next?

   • AClose the alert as a false positive because the user is on vacation.
   • BWait for additional alerts before taking any action.
   • CDisable the user's account immediately to prevent further access.
   • DEscalate the alert to tier 2 for immediate incident response.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC analyst is handling an alert that indicates a possible data exfiltration from a database server. The analyst must decide whether to escalate immediately or continue investigating. The company has a strict policy that all potential data breaches must be reported to management within one hour. The analyst has spent 45 minutes investigating and has not confirmed the exfiltration. What should the analyst do?

   • AClose the alert as a false positive because confirmation is not yet possible.
   • BEscalate the alert now and provide preliminary findings to management.
   • CContinue investigating until the exfiltration is confirmed before escalating.
   • DEscalate only after the investigation is complete, regardless of the time.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A SOC team is implementing a new process for handling alerts. The team wants to reduce the time to respond to critical incidents while maintaining thorough investigation. Which process design would best achieve this?

   • AUse a tiered response model where tier 1 performs initial triage and escalates critical alerts to tier 2 for deep investigation.
   • BHave every analyst investigate every alert fully before escalation.
   • CEscalate all alerts to the most senior analyst for investigation.
   • DAutomate all investigation steps without human review.
   Reveal Solution Discussion Select an answer first