SOC Management Systems GSOC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC has a mature incident response process but relies on manual log review and lacks automated alerting. According to a SOC maturity model, which capability area is most likely at a lower maturity level?

   • ADetection and monitoring
   • BGovernance and management
   • CThreat intelligence integration
   • DIncident response
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst receives an alert for a potential malware infection on a user's workstation. The analyst checks the SIEM and sees that the alert is from a known false-positive signature. The analyst closes the alert without further investigation. Later, the workstation is confirmed to be infected. Which step in the incident response process was most likely skipped?

   • AContainment
   • BTriage and validation
   • CLessons learned
   • DEradication
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC team is overwhelmed by a high volume of low-fidelity alerts, causing analysts to miss critical incidents. They want to reduce alert fatigue while ensuring that important alerts are still investigated. Which approach would be most effective?

   • AIncrease the number of analysts to manually review all alerts.
   • BRequire analysts to document every alert in the ticketing system.
   • CDisable all alerts that have a high false-positive rate.
   • DImplement a SOAR platform to automate triage and enrichment of alerts.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC wants to automate the collection of indicators of compromise (IOCs) from a threat intelligence feed and automatically block them on the firewall. Which technology is best suited for this task?

   • AEDR
   • BSOAR
   • CTicketing system
   • DSIEM
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC operates in a country with strict data residency laws, requiring that all security logs be stored within the country. The SOC currently uses a cloud SIEM with data centers in multiple regions. Which approach best ensures compliance?

   • AEncrypt all logs before sending them to the cloud
   • BConfigure the SIEM to store data only in the in-country region
   • CUse a private cloud for the SIEM
   • DAnonymize all logs before storage
   Reveal Solution Discussion Select an answer first