SOC Workflow, Processes, and Challenges SCE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC team is facing a high volume of alerts from a new EDR tool. The alerts are mostly false positives, but the team is concerned about missing real threats. The team has limited staffing and cannot manually review every alert. They have a SIEM that can integrate with the EDR. What is the most effective approach to reduce alert fatigue while maintaining security?

   • ADisable the EDR alerts and rely on the SIEM for all detection
   • BIntegrate the EDR with the SIEM and create correlation rules to filter out known false positives
   • CIncrease the EDR alert threshold to only report critical events
   • DHire additional analysts to handle the alert volume
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC team is struggling with alert fatigue because the SIEM generates too many low-severity alerts. The team wants to improve the quality of alerts without missing real threats. What should they do?

   • AAdd more monitoring tools to get more context
   • BTune the SIEM correlation rules to reduce false positives
   • CIncrease the severity level of all alerts
   • DDisable all low-severity alerts
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC team is experiencing alert fatigue due to a high volume of low-severity alerts. The team has a SOAR platform but has not fully automated any workflows. The manager wants to reduce the burden on analysts while ensuring that critical alerts are still investigated. What is the most effective way to use the SOAR platform?

   • AAutomate the response to all alerts without analyst review
   • BUse the SOAR platform to generate more alerts for context
   • CAutomate the triage and enrichment of low-severity alerts
   • DUse the SOAR platform to replace the SIEM
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC team is overwhelmed by the volume of low-priority alerts from multiple security tools. They want to reduce noise while ensuring critical alerts are still reviewed. Which process improvement would best address this challenge?

   • AAssign all alerts to the most senior analyst for review.
   • BIncrease the number of alerts forwarded to the SIEM for comprehensive coverage.
   • CImplement a triage process that categorizes alerts by severity and assigns them to the appropriate tier.
   • DDisable all alerts from tools that generate false positives.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which SOC process involves continuously examining logs, network traffic, and system events to identify potential security incidents?

   • AEscalation
   • BTriage
   • CMonitoring
   • DReporting
   Reveal Solution Discussion Select an answer first