SOC Workflow, Processes, and Challenges SCE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC manager notices that analysts spend too much time manually correlating logs from different security tools. The team is also understaffed. Which solution would most effectively address both challenges?

   • ADeploy a SOAR platform to automate repetitive correlation and enrichment tasks.
   • BReduce the number of security tools to minimize log sources.
   • CIncrease the alert threshold to reduce the number of logs to review.
   • DHire more analysts to handle the manual correlation.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SOC team is evaluating whether to replace their existing SIEM with a new one. The current SIEM is reliable but generates many false positives. The new SIEM has better analytics but requires significant integration effort and training. The team is already understaffed. What is the most important factor to consider in this decision?

   • AThe fact that the current SIEM is already paid for.
   • BThe color scheme of the new SIEM's dashboard.
   • CThe potential reduction in false positives versus the cost and effort of migration.
   • DThe vendor's marketing claims about the new SIEM's capabilities.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC team uses a SIEM that generates a high volume of alerts. The team is short-staffed, and analysts often miss critical alerts because they are buried in noise. The SOC manager wants to improve detection without increasing headcount. Which approach best balances alert volume and detection coverage?

   • AIncrease the alert threshold for all rules to reduce the number of alerts.
   • BOutsource the monitoring function to a managed security service provider.
   • CAutomate responses to all alerts using a SOAR platform.
   • DImplement a risk-based alert prioritization system and tune detection rules to reduce false positives.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a security incident, a SOC analyst identifies a compromised host and isolates it from the network. According to the SOC workflow, what should the analyst do after containment?

   • ADelete all logs related to the incident.
   • BDocument the actions taken and begin the eradication phase.
   • CNotify the public about the breach.
   • DImmediately restore the host to production.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC team is responding to a ransomware incident. The incident response plan requires preserving evidence for potential legal action. However, the fastest way to recover is to reimage the affected servers. What should the team do?

   • AAsk the attacker for the decryption key before reimaging.
   • BTake forensic images of the affected systems before reimaging.
   • CIgnore the legal requirement and focus on recovery.
   • DReimage the servers immediately to restore operations quickly.
   Reveal Solution Discussion Select an answer first