SOC Design and Planning GSOM Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A multinational company operates three regional data centers, each with its own security team that currently handles incidents independently. The CISO wants to improve detection consistency and reduce duplicate alert investigations while preserving local response autonomy. Which SOC architecture model best meets these requirements?

   • AVirtual SOC with outsourced analysts and no physical presence
   • BHybrid SOC with a central coordination function and regional execution teams
   • CCentralized SOC with all analysts in one location
   • DDistributed SOC with independent regional teams and no central coordination
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What does the 'False Positive Rate' metric indicate about a SOC's performance?

   • AThe number of incidents that were missed by the SOC
   • BThe total number of alerts generated in a day
   • CThe average time to respond to an incident
   • DThe percentage of alerts that are incorrectly identified as incidents
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of a standard operating procedure (SOP) in a SOC?

   • ATo define the organizational hierarchy of the SOC
   • BTo document the steps for responding to a specific type of incident
   • CTo set the budget for the SOC
   • DTo list the hardware requirements for the SOC
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC has a standard operating procedure that requires all high-severity alerts to be escalated to the incident response team within 15 minutes. However, the SOC is understaffed on the night shift, and analysts often miss the 15-minute target. The SOC manager needs to improve compliance with the procedure without increasing headcount. Which approach is most effective?

   • AImplement an automated alert routing rule in the SIEM that pages the on-call incident responder directly for high-severity alerts
   • BReduce the number of high-severity alerts by tuning detection rules
   • CChange the SOP to allow 30 minutes for escalation
   • DTrain analysts to prioritize high-severity alerts over other tasks
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A SOC manager is reviewing the team's performance metrics. The current metrics show a low mean time to respond (MTTR) but a high number of incidents that recur. The manager suspects that the team is containing incidents quickly but not fully remediating root causes. Which additional metric would best help evaluate this concern?

   • APercentage of alerts generated by the SIEM
   • BNumber of threat intelligence feeds used
   • CNumber of incidents reopened within 30 days
   • DAverage time to escalate to senior analysts
   Reveal Solution Discussion Select an answer first