SOC Analytics and Metrics GSOM Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC manager needs to present quarterly performance to a non-technical executive audience. The executives are most concerned about the SOC's contribution to business continuity and regulatory compliance. Which presentation approach is most effective?

   • APresent trends in mean time to detect and respond, with a narrative explaining how improvements reduce business impact
   • BProvide a detailed technical report of every detection rule and its tuning history
   • CHighlight the percentage of incidents that were contained before affecting critical business functions, along with compliance-related metrics such as audit findings
   • DShow a dashboard with raw counts of alerts, incidents, and false positives for each month
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a common SOC metric used to measure the effectiveness of incident response?

   • AEmployee Training Hours
   • BServer Uptime Percentage
   • CNumber of Firewall Rules
   • DMean Time to Contain (MTTC)
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC manager is analyzing the trend of mean time to respond (MTTR) over the past year. The data shows a steady decline, but the manager suspects the improvement is due to a change in how the metric is calculated, not actual performance improvement. What is the best way to verify this?

   • AAsk analysts if they feel they are responding faster
   • BAssume the improvement is real because the data is consistent
   • CCompare the current MTTR to the industry average
   • DReview the calculation methodology for any changes during the period
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC manager wants to use analytics to identify gaps in detection coverage. The team currently tracks the number of alerts per rule and the number of incidents per rule. Which additional analysis would best help identify coverage gaps?

   • ACalculate the average time to triage for each rule
   • BCompare the rules' alert volumes to the MITRE ATT&CK techniques they cover
   • CReview the number of false positives per rule
   • DCount the total number of rules in the SIEM
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC manager is asked by the compliance officer to report on the effectiveness of the SOC's monitoring controls. The compliance officer is not familiar with security operations terminology. Which metric would be most meaningful to this stakeholder?

   • AAverage number of rules per analyst
   • BMean time to detect (MTTD) in minutes
   • CTotal number of SIEM events processed per day
   • DPercentage of critical alerts that were investigated within the SLA
   Reveal Solution Discussion Select an answer first