SOC Analytics and Metrics GSOM Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC manager analyzes the past six months of data and finds that the mean time to respond (MTTR) is consistently higher during night shifts. The manager wants to improve this. What is the most effective improvement action?

   • AChange the MTTR metric to exclude night shifts
   • BReduce the number of alerts sent to the night shift
   • CAdd more analysts to the night shift
   • DInvestigate the root cause, such as fewer senior analysts on night shifts or lack of escalation procedures
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A SOC manager wants to demonstrate to the board of directors that the SOC is effectively protecting the organization. Which metric would be most aligned with this stakeholder's interest?

   • APercentage of critical incidents resolved within SLA
   • BAverage CPU usage of SOC workstations
   • CNumber of security alerts processed per day
   • DNumber of firewall rule changes per month
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC manager reviews the monthly mean time to respond (MTTR) metric and notices it has been steadily increasing over the past three months. The manager wants to determine whether this is a real degradation or just random variation. Which analytical approach is most appropriate?

   • APlot MTTR over time and apply a moving average to smooth out short-term fluctuations
   • BCompare the latest month's MTTR to the previous month's MTTR
   • CCalculate the average MTTR for the entire year and compare it to the industry benchmark
   • DLook at the total number of incidents each month to see if the volume changed
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which activity best exemplifies the scope of SOC analytics?

   • AAssigning incident tickets to analysts based on their current workload
   • BBacking up security logs to an offsite storage location
   • CConfiguring a firewall rule to block a known malicious IP address
   • DReviewing historical incident data to identify recurring attack vectors
   Reveal Solution Discussion Select an answer first
6. 25application · easy

   A SOC manager is preparing a quarterly report for the CEO. The CEO wants to know whether the SOC is improving over time. Which presentation of metrics is most effective for this purpose?

   • AA line chart showing the trend of mean time to detect and respond over the past four quarters
   • BA bar chart comparing the current quarter's false positive rate to the industry average
   • CA pie chart showing the distribution of alert severities for the current quarter
   • DA table listing the raw number of alerts and incidents for each month
   Reveal Solution Discussion Select an answer first