SOC Analytics and Metrics GSOM Practice Questions (Page 9)

Questions 41–44

1. 41foundation · easy

   When reporting SOC performance metrics to a non-technical executive audience, what is the most effective approach?

   • AProvide raw data tables and detailed technical explanations
   • BFocus exclusively on the number of security incidents detected
   • CUse visual dashboards with trend lines and concise summaries highlighting key takeaways
   • DAvoid sharing negative trends to prevent alarming the audience
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SOC manager observes that the false positive rate has increased from 20% to 45% over the last month, while the true positive rate has remained stable. The SOC's alert volume has also increased. What is the most appropriate first action to improve SOC effectiveness?

   • AIncrease the number of analysts to handle the higher alert volume
   • BDisable all detection rules that have any false positives
   • CReview and tune the detection rules that are generating the most false positives
   • DReduce the alert volume by lowering the severity threshold for all rules
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A SOC manager wants to calculate the percentage of alerts that are true positives. The SIEM logs alerts, but the analyst disposition is recorded in a ticketing system that is not always updated. The manager has limited time and needs a reliable estimate. What is the best approach?

   • AStop calculating the metric until the ticketing system is fixed
   • BRun a sample of alerts and manually review them to estimate the true positive rate
   • CAssume that all alerts without a ticket are false positives
   • DUse the ticketing system data as-is, even if it is incomplete
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which method is commonly used to collect data for computing SOC metrics such as Mean Time to Detect (MTTD)?

   • AAutomated extraction from ticketing and SIEM systems
   • BReviewing firewall configuration files
   • CSurveying customers about their satisfaction with SOC services
   • DManual entry of analyst observations into a spreadsheet
   Reveal Solution Discussion Select an answer first