SOC Tools and Technology GSOM Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A SOC manager is designing a new SOC and needs to ensure that alerts from network sensors, endpoint agents, and cloud logs are centralized and that response actions can be automated. Which combination of tool categories is essential?

   • AEDR and ticketing system
   • BSIEM and SOAR
   • CTicketing system and SOAR
   • DVulnerability scanner and SIEM
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC uses a SIEM, an EDR platform, and a ticketing system. Analysts currently copy alert details from the SIEM into tickets manually and then open the EDR console to check the endpoint. The manager wants to reduce manual effort and speed up triage. Which action best achieves this?

   • AAsk analysts to use a browser bookmark for the EDR console
   • BConfigure the SIEM to automatically create tickets and include a deep link to the EDR investigation view
   • CIncrease the SIEM alert threshold to reduce the number of tickets
   • DReplace the ticketing system with a shared spreadsheet
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A SOC manager is planning to retire an old SIEM and migrate to a new one. The old SIEM contains six years of log data that is required for compliance. The new SIEM has a different data schema. What is the best approach to preserve the data?

   • ADelete the old data after confirming the new SIEM is operational
   • BKeep the old SIEM running solely for historical queries
   • CImport all historical data into the new SIEM after converting the schema
   • DExport the data in a standard format (e.g., CEF) and store it in a separate archival system
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC manager wants to automate the containment of compromised endpoints. The SOAR playbook will isolate the endpoint via the EDR API. However, the team is concerned about accidentally isolating a critical production server. What is the best way to implement this automation safely?

   • AAutomate isolation only during business hours
   • BRequire analyst approval for isolation of endpoints on a critical-asset list
   • CAutomate isolation for all endpoints to ensure rapid response
   • DDo not automate isolation; always perform it manually
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC wants to enrich SIEM alerts with threat intelligence feeds. The team has a SOAR platform. What is the most efficient way to achieve this?

   • AImport the threat intelligence feed into the SIEM as a static list
   • BHave analysts manually check the threat intelligence portal for each alert
   • CConfigure a SOAR playbook that queries the threat intelligence feed and appends the results to the alert
   • DAsk the threat intelligence vendor to send email alerts
   Reveal Solution Discussion Select an answer first