SOC Design and Planning GSOM Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary purpose of a threat intelligence feed in a SOC?

   • ATo replace the need for a SIEM
   • BTo provide context about emerging threats and indicators of compromise
   • CTo store historical logs for compliance
   • DTo automate all incident response actions
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SOC manager is assessing the maturity of their SOC. The team currently has ad-hoc processes, relies heavily on individual analyst knowledge, and has no formal metrics. The manager wants to move to a more mature state. Which improvement should be prioritized first?

   • ADefine and document standard operating procedures (SOPs) for common incident types
   • BImplement a new SIEM platform
   • CIncrease the number of analysts on staff
   • DPurchase advanced threat hunting tools
   Reveal Solution Discussion Select an answer first
4. 43expert · medium

   A SOC manager is planning the budget for the next year. The SOC currently has a SIEM, but it is underutilized because analysts lack training. The manager has a limited budget and must choose between additional training for analysts and upgrading the SIEM to a more advanced version. Which choice is more likely to improve SOC effectiveness?

   • APurchase additional threat intelligence feeds
   • BUpgrade the SIEM to a more advanced version
   • CHire additional analysts
   • DInvest in additional training for analysts
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company is establishing a SOC. The business's primary objective is to protect intellectual property from industrial espionage. The SOC manager needs to define the SOC's mission and scope. Which mission statement best aligns with the business objective?

   • ADetect and respond to threats that target the company's trade secrets and proprietary data
   • BMonitor all network traffic and block any suspicious activity
   • CProvide 24/7 monitoring of all IT systems
   • DEnsure compliance with all industry regulations
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A multinational corporation operates three regional data centers, each with a local security team that currently handles its own monitoring and incident response. The CISO wants to improve consistency of detection rules and reduce duplicate alert handling, but the regional teams must retain the ability to respond quickly to localized incidents. Which SOC architecture model best meets these requirements?

   • ACentralized SOC with all monitoring and response performed from a single global hub
   • BDistributed SOC with each regional team operating independently with no shared visibility
   • CHybrid SOC with centralized monitoring and detection engineering, and regional teams performing local response
   • DVirtual SOC using outsourced MSSP for all monitoring and response
   Reveal Solution Discussion Select an answer first