Managing a Security Operations Center GSLC Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC is considering implementing a SOAR (Security Orchestration, Automation, and Response) platform to automate repetitive tasks. The SOC has a small team and a high volume of low-severity alerts. Which consideration is most important when evaluating SOAR?

   • AThe color of the SOAR vendor's logo.
   • BThe SOAR platform's ability to replace the need for human analysts entirely.
   • CThe number of employees at the SOAR vendor.
   • DThe ability to integrate with existing SIEM, ticketing, and other security tools.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A mid-sized company's SOC currently relies on manual log review and email alerts from individual security tools. The team misses correlated attacks that span multiple systems. The SOC manager wants to improve detection capability with a central platform. Which technology should be prioritized?

   • ADeploy a SIEM platform to aggregate logs and generate correlated alerts.
   • BInstall a network-based intrusion detection system (IDS) at the internet perimeter.
   • CImplement a vulnerability scanner to identify missing patches.
   • DUpgrade the existing email gateway to include advanced threat protection.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In the context of SOC maturity models, what characterizes a 'Level 1' or 'initial' SOC?

   • AProactive threat hunting integrated into daily operations
   • BAd hoc processes with limited formalization and reactive monitoring
   • CFully automated response with machine learning-driven detection
   • DContinuous improvement with defined KPIs and regular reviews
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A SOC manager is reviewing the team's performance metrics. The team has a high number of alerts, but the mean time to respond (MTTR) is low. However, the number of incidents that escalate to Tier 3 is high. The manager suspects that Tier 1 analysts are closing alerts too quickly without proper investigation. Which metric would best help confirm this suspicion?

   • ANumber of alerts per analyst per shift.
   • BNumber of false positives reported by the team.
   • CAverage time to escalate alerts to Tier 2.
   • DPercentage of alerts closed without being escalated or investigated beyond initial triage.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company is considering whether to build an in-house SOC or outsource to a managed security service provider (MSSP). The company has a small security team and limited budget. Which factor is most important to consider when making this decision?

   • AThe company's stock price.
   • BThe ability to maintain 24/7 monitoring coverage.
   • CThe number of employees in the company.
   • DThe color of the SOC's logo.
   Reveal Solution Discussion Select an answer first