SOC Analytics and Metrics GSOM Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC manager must report to two stakeholders with conflicting needs. The CISO wants to see a decrease in mean time to respond (MTTR). The compliance officer wants to see that all incidents are documented and tracked. The manager has limited time to prepare the report. What is the best approach?

   • APrepare two separate reports, one for each stakeholder, focusing on their specific metric
   • BCreate a single report that shows MTTR trends and incident documentation compliance side by side
   • CReport only incident documentation compliance because it is required by regulation
   • DReport only MTTR because it is the most important metric
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of SOC analytics?

   • ATo transform raw security data into actionable insights that support decision-making
   • BTo automate incident response actions without human intervention
   • CTo collect and store security event logs for compliance purposes
   • DTo replace the need for human analysts by using machine learning models
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC manager must present the team's performance to a non-technical executive audience. The executives want to know whether the SOC is improving. Which reporting approach is most effective?

   • AShow a line chart of key metrics over time with a brief narrative explaining the trend
   • BList the top 10 alerts by volume and explain how each was handled
   • CPresent a single overall score that combines all metrics into one number
   • DProvide a detailed table of all metrics with raw numbers and technical definitions
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A SOC analyst observes that the number of alerts spikes every weekday at 9:00 AM. What is the most likely explanation for this pattern?

   • AThe SIEM is generating false positives due to a misconfiguration
   • BThe SOC is running daily vulnerability scans at that time
   • CA new malware campaign is targeting the organization every morning
   • DEmployees are starting work and generating normal network activity that triggers alerts
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC manager notices that the mean time to detect (MTTD) has increased significantly over the past quarter. Analysis shows that a specific detection rule is generating a high volume of low-fidelity alerts, causing analysts to spend more time triaging. What is the most appropriate improvement action?

   • AIncrease the number of analysts on the team
   • BDisable the detection rule immediately
   • CTune the rule to reduce false positives while preserving detection of true positives
   • DChange the MTTD metric to exclude alerts from that rule
   Reveal Solution Discussion Select an answer first