5.3 Implementing the Case Management Lifecycle PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A SOC manager is evaluating the handoff process and finds that the night shift often has to redo steps that were already completed by the day shift. The manager suspects that the handoff documentation is not clear about what has been done. Which metric would best help the manager identify the root cause?

   • AThe number of analysts on the night shift
   • BThe number of times the night shift repeats actions already documented
   • CThe average time to escalate a case
   • DThe total number of cases handled by the night shift
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC manager is analyzing handoff metrics and notices that the number of cases reopened due to missing information has increased over the past month. Which action would be most effective to address this issue?

   • AEscalate all cases to the next tier immediately
   • BReview recent handoff documentation to identify common missing fields
   • CReduce the number of cases handled per day
   • DIncrease the number of analysts on the team
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security analyst is creating handoff documentation for a case that is being transferred to another team. Which of the following should be included in the documentation?

   • AThe names of all employees in the organization
   • BA summary of actions taken and current status
   • CThe personal opinions of the analyst about the case
   • DOnly the case ID and the original alert
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A SOC analyst identifies a potential ransomware infection that is spreading across multiple critical servers. The case requires immediate containment expertise beyond the tier-1 team. According to escalation workflow best practices, what should the analyst do?

   • AClose the case and create a new one for the specialized team
   • BEscalate the case to a higher tier or specialized incident response team
   • CContinue working the case alone until containment is achieved
   • DWait for the next shift to handle the case
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A SOC is handling a case involving a potential insider threat. The case has been in the triage stage for two hours. The analyst has confirmed that a user accessed sensitive data outside of normal working hours, but the analyst is unsure if this is malicious. The SOC's escalation policy states that cases involving potential insider threats must be escalated to the threat hunting team if not resolved within one hour. What should the analyst do?

   • AWait for the user to explain the access before escalating
   • BEscalate the case to the threat hunting team immediately
   • CClose the case because the access was not confirmed as malicious
   • DContinue the investigation until the intent is confirmed
   Reveal Solution Discussion Select an answer first