SOC Design and Planning GSOM Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC manager is preparing a budget for the next fiscal year. The organization has a limited budget and wants to maximize the SOC's effectiveness. The current SOC lacks a SIEM and relies on manual log review. Which budget allocation is most likely to provide the greatest improvement in detection capability?

   • AInvest in a SIEM platform and associated log management
   • BPurchase a commercial threat intelligence feed
   • CInvest in a new office location for the SOC
   • DHire additional junior analysts
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC analyst receives an alert for a potential malware infection on a critical server. The alert is ambiguous—it could be a false positive. According to the SOC's standard operating procedures, what should the analyst do FIRST?

   • AClose the alert as a false positive based on initial impression
   • BPerform initial triage by checking the alert details and correlating with other logs to determine if it is a true positive
   • CIsolate the server from the network immediately
   • DEscalate the alert immediately to the incident response team
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a key advantage of a hybrid SOC architecture?

   • AIt eliminates the need for any local presence at remote sites
   • BIt requires only one physical location for all operations
   • CIt provides centralized oversight while allowing local execution where needed
   • DIt is always cheaper than a centralized or distributed model
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary responsibility of a SOC manager?

   • AMonitoring alerts on a daily basis
   • BOverseeing SOC operations, personnel, and strategic alignment with the organization
   • CPerforming deep-dive forensic analysis on compromised hosts
   • DWriting detection rules for the SIEM platform
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A SOC manager is selecting a SOAR platform. The SOC has a small team and a limited budget. The primary goal is to automate repetitive triage tasks, such as enriching alerts with threat intelligence and opening tickets. The team has moderate scripting skills. Which SOAR approach best fits these constraints?

   • AA SOAR platform that requires full-time dedicated administrators to maintain
   • BAn open-source SOAR platform that requires extensive custom coding for every integration
   • CA custom-built automation framework using internal scripts
   • DA commercial SOAR platform with a large library of pre-built integrations and playbooks
   Reveal Solution Discussion Select an answer first