5.3 Implementing the Case Management Lifecycle PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC manager is analyzing handoff metrics and finds that the average time to resolve a case after a handoff has increased by 20%. The manager suspects that the handoff documentation is incomplete. Which metric would best confirm this suspicion?

   • AThe total number of cases handled per month
   • BThe number of times the next analyst had to contact the previous analyst for clarification
   • CThe number of analysts on the team
   • DThe average severity of cases handled
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC is designing an escalation workflow for cases involving ransomware. The team wants to ensure that any case where a critical server is infected is escalated to the threat hunting team within 15 minutes of detection. Which of the following should be defined to implement this requirement?

   • AA post-incident review template for documenting lessons learned
   • BA containment strategy that isolates critical servers
   • CA case handoff document that describes the threat hunting team's procedures
   • DA service level agreement (SLA) that specifies the 15-minute escalation time
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC manager wants to measure the effectiveness of case handoffs between shifts. The goal is to identify areas where information is lost or misunderstood during transitions. Which metric would be most useful for this purpose?

   • AThe total number of cases handled per day
   • BThe number of analysts on the team
   • CThe average time to escalate a case
   • DThe number of cases reopened due to missing information after a handoff
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A SOC wants to measure the effectiveness of its case handoff process. Which of the following is a suitable metric for this purpose?

   • ANumber of cases that require re-work after handoff
   • BNumber of analysts on the team
   • CAverage time to close resolved cases
   • DTotal number of security alerts generated per day
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A SOC team maintains handoff documentation for cases that are transferred between shifts. What is the primary purpose of this documentation?

   • ATo satisfy regulatory compliance requirements
   • BTo replace the need for direct communication between teams
   • CTo track the performance of individual analysts
   • DTo enable seamless case transfer by providing complete context
   Reveal Solution Discussion Select an answer first