4.1 Establish and Maintain Security Operations Center ISSMP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of a SOC playbook?

   • ATo document the configuration of security tools
   • BTo define the overall mission and objectives of the SOC
   • CTo provide step-by-step guidance for handling a specific type of security incident
   • DTo record the outcomes of past incidents
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of a standard operating procedure (SOP) in a SOC?

   • ATo document the history of all security incidents
   • BTo provide a high-level overview of the SOC's mission
   • CTo define the step-by-step actions for a specific operational task
   • DTo list the hardware specifications of SOC workstations
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following best describes the role of SOC documentation in establishing a new security operations center?

   • AIt establishes the operational framework, including roles, processes, and procedures
   • BIt provides the legal basis for prosecuting cybercriminals
   • CIt defines the technical architecture of the SOC's tools and platforms
   • DIt serves as a marketing tool to demonstrate security capabilities to customers
   Reveal Solution Discussion Select an answer first
5. 4expert · hard · select all that apply

   A SOC manager is reviewing the SOC's documentation and finds that the incident response SOP is outdated and does not reflect the current toolset. The manager also notices that the playbooks for specific threats are not aligned with the SOP. Which actions should the manager take to address these issues? (Select all that apply.)

   • AReview and update all playbooks to align with the revised SOP.
   • BWait for the next major incident to update the documentation.
   • CEstablish a regular review cycle for all SOC documentation.
   • DUpdate the incident response SOP to reflect the current toolset and processes.
   • EDelete the outdated playbooks and rely on the SOP alone.
   Check answers Discussion Select an answer first
6. 5application · medium

   A SOC is being established, and the manager must ensure that the team has clear guidance for both routine operations and specific incident scenarios. The manager wants to create a set of documents that covers both the 'how' of daily work and the 'what to do when X happens'. Which combination of documents should the manager develop?

   • AA SOC charter and a list of KPIs.
   • BA single comprehensive policy that covers all aspects of SOC operations.
   • CStandard operating procedures for routine tasks and playbooks for specific incident types.
   • DPlaybooks for routine tasks and policies for incident response.
   Reveal Solution Discussion Select an answer first