A SOC team is struggling because the SIEM generates too many alerts, and analysts cannot keep up. Which combination of actions would best address this challenge?

Reduce the log retention period to decrease data volume.

Tune SIEM correlation rules and implement an alert prioritization scheme.

Increase the number of SIEM alerts and hire more analysts.

Disable the SIEM and rely on manual log review.

After a security incident is resolved, a SOC manager wants to improve future response. Which activity is part of the post-incident phase of the SOC workflow?

Increasing the alert threshold to reduce future alerts.

Conducting a lessons-learned review to identify gaps and improvements.

Immediately returning all systems to production without review.

Deleting all incident-related logs to free up storage.

A SOC analyst receives an alert about a possible malware infection on a user's workstation. The analyst has confirmed the alert is a true positive and the workstation is actively communicating with a known command-and-control server. What should the analyst do next in the SOC process?

Escalate the incident to the incident response team

Close the alert as a false positive

Wait for additional alerts before acting

Reboot the workstation to clear the infection

A SOC team is experiencing high turnover and struggles to retain experienced analysts. Which strategy would most directly address the staffing challenge while improving SOC effectiveness?

Outsource all monitoring to a third-party provider.

Reduce the use of automation to keep analysts engaged.

Increase the number of alerts each analyst handles per shift.

Implement a mentorship program and provide clear career progression paths.

A SOC team is reviewing its incident response process after a major security incident. The team found that the incident was not detected until several days after the initial compromise because the relevant logs were not being monitored. The team wants to improve detection capabilities. What is the most important process to implement?

A stricter escalation procedure

A more detailed incident reporting process

A more comprehensive incident response plan

Continuous monitoring of all relevant log sources

EC-CouncilSOC Essentials

Domain 3Objective 4

SOC Workflow, Processes, and Challenges SCE Practice Questions (Page 6)

Part of the Introduction to the Security Operations Center domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

3concepts

Questions 26–30

26application · medium
A SOC team is struggling because the SIEM generates too many alerts, and analysts cannot keep up. Which combination of actions would best address this challenge?
Select an answer first
27application · medium
After a security incident is resolved, a SOC manager wants to improve future response. Which activity is part of the post-incident phase of the SOC workflow?
Select an answer first
28application · medium
A SOC analyst receives an alert about a possible malware infection on a user's workstation. The analyst has confirmed the alert is a true positive and the workstation is actively communicating with a known command-and-control server. What should the analyst do next in the SOC process?
Select an answer first
29application · medium
A SOC team is experiencing high turnover and struggles to retain experienced analysts. Which strategy would most directly address the staffing challenge while improving SOC effectiveness?
Select an answer first
30expert · hard
A SOC team is reviewing its incident response process after a major security incident. The team found that the incident was not detected until several days after the initial compromise because the relevant logs were not being monitored. The team wants to improve detection capabilities. What is the most important process to implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.