SOC Analytics and Metrics GSOM Practice Questions (Page 6)

Questions 26–30

1. 26application · easy

   A SOC manager is asked to report on the SOC's effectiveness to the head of IT operations, who is primarily concerned with the SOC's impact on system availability. Which metric is most relevant to this stakeholder?

   • ANumber of false positives per month
   • BPercentage of incidents that caused downtime or degradation of critical services
   • CMean time to respond (MTTR) to critical incidents
   • DPercentage of alerts that were escalated to the incident response team
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is a key characteristic of an actionable SOC performance report?

   • AIt lists every security event that occurred during the reporting period
   • BIt includes recommendations for improvement based on the metric trends
   • CIt uses technical jargon to demonstrate expertise
   • DIt only reports metrics that meet targets
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC manager is asked to report on the SOC's performance to the legal department, which is concerned about compliance with data breach notification laws. Which metric is most relevant?

   • ANumber of incidents that involved ransomware
   • BMean time to respond (MTTR) for all incidents
   • CMean time to detect (MTTD) for incidents involving personal data
   • DPercentage of alerts that are false positives
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   A SOC manager analyzes metrics and finds that the false positive rate is unusually high. Which action best applies this analytical insight to improve SOC operations?

   • AIgnore the metric because false positives are not important
   • BDisable all alerts to eliminate false positives
   • CReview and tune detection rules to reduce false positives
   • DIncrease the number of alerts monitored by analysts
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SOC manager reviews the monthly metric 'percentage of alerts closed without action' and notices it has dropped from 60% to 30% over three months. The total alert volume has not changed. What is the most likely explanation?

   • AAnalysts are now investigating more alerts before closing them
   • BThe SIEM is generating fewer false positives
   • CAnalysts are closing alerts without action more often
   • DThe detection rules have been changed to generate more true positives
   Reveal Solution Discussion Select an answer first