SOC Analytics and Metrics GSOM Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   A SOC manager notices that the Mean Time to Detect (MTTD) has been steadily increasing over the past three months. What does this trend most likely indicate?

   • AThe SOC is improving its incident response efficiency
   • BThe SOC's detection capability is degrading or the threat landscape is changing
   • CThe SOC is reducing false positives
   • DThe SOC is detecting incidents faster over time
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC manager needs to report to the IT director, who wants to know if the SOC is overworked. The director is concerned about staff burnout. Which metric would best support this discussion?

   • APercentage of false positives
   • BTotal number of SIEM events per day
   • CMean time to detect (MTTD)
   • DNumber of alerts per analyst per shift
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC manager notices that the 'mean time to respond (MTTR)' has been decreasing, but the 'percentage of incidents that recur within 30 days' has been increasing. What is the most likely cause?

   • AAnalysts are closing incidents without fully remediating the root cause
   • BThe incident response team is taking over incidents earlier
   • CThe SIEM is generating more false positives, which are resolved quickly
   • DThe SOC is detecting incidents faster, so they are less severe
   Reveal Solution Discussion Select an answer first
5. 39application · easy

   A SOC manager wants to calculate the 'percentage of alerts handled within SLA' metric. The SOC uses a ticketing system, a SIEM, and a chat tool for collaboration. Which data source is the most reliable for this metric?

   • AThe SIEM's correlation engine logs
   • BThe ticketing system's creation and closure timestamps
   • CThe chat tool's message timestamps from analysts discussing alerts
   • DThe SIEM's alert generation timestamps
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC manager reviews the weekly false positive rate and sees it spiked from 20% to 60% in one week. The manager suspects a recent change to a detection rule. What is the most appropriate next step?

   • ACorrelate the spike with the timing of the rule change and analyze the alerts generated by that rule
   • BRevert the rule change immediately
   • CIncrease the alert threshold for that rule
   • DIgnore the spike because it is only one week
   Reveal Solution Discussion Select an answer first