SOC Analytics and Metrics GSOM Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC manager is asked to provide a metric that demonstrates the SOC's value to the business. The company's main concern is protecting customer data. Which metric would be most meaningful?

   • APercentage of false positives
   • BTotal number of alerts processed
   • CNumber of incidents involving customer data
   • DMean time to detect (MTTD)
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC manager must choose a set of metrics for a quarterly board presentation. The board cares about business risk and resource allocation, while the SOC team cares about operational efficiency. Which metric set best balances both audiences?

   • AMean time to detect (MTTD) and mean time to respond (MTTR)
   • BTotal number of incidents and average severity score
   • CNumber of alerts triaged and percentage of alerts escalated
   • DPercentage of incidents impacting critical assets and cost per incident
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC manager is reviewing monthly metrics and notices that the mean time to respond (MTTR) has decreased significantly, but the number of incidents that escalate to major incidents has increased. What is the most likely explanation?

   • AThe SIEM is generating more false positives, inflating the MTTR calculation
   • BAnalysts are closing alerts faster without fully investigating them
   • CThe SOC has improved its response procedures, leading to faster containment
   • DThe incident response team is taking over cases earlier in the process
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A SOC manager is aligning metrics with the goal of 'reducing the impact of security incidents.' Which metric best supports this objective?

   • ANumber of SOC analysts on staff
   • BNumber of security tools deployed
   • CMean Time to Contain (MTTC)
   • DTotal log storage capacity
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC manager analyzes six months of metrics and finds that the mean time to detect (MTTD) is consistently higher for alerts originating from cloud-based systems than for on-premises systems. The SOC uses the same detection rules for both environments. What is the most likely cause?

   • ACloud systems are less secure, so they generate more true positives
   • BCloud systems generate more false positives, which delays detection
   • CCloud log sources have a longer ingestion delay than on-premises sources
   • DAnalysts are less familiar with cloud environments, so they take longer to investigate
   Reveal Solution Discussion Select an answer first