Which of the following is a best practice for maintaining SOC documentation?

Allow any analyst to edit documentation without review

Keep documentation in a single shared drive without version control

Update documentation only when a major incident occurs

Assign a designated owner for each document and schedule periodic reviews

A SOC manager is reviewing the SOC's documentation and finds that several playbooks reference outdated tools and processes that were replaced six months ago. The manager wants to prevent this from happening again. What should the manager implement?

A new playbook that covers all possible incident scenarios.

A formal review cycle that requires all documentation to be reviewed and updated after any significant change to tools or processes.

A procedure that requires analysts to document any deviations from the playbooks.

A policy that requires all SOC analysts to read the playbooks annually.

Which of the following tasks would most likely be documented in a SOC standard operating procedure?

Defining the SOC's incident response escalation hierarchy

Providing the step-by-step process for triaging incoming alerts

Describing the organization's business model

Stating the SOC's overall security objectives

What should a SOC policy primarily define?

The daily shift schedule for SOC analysts

The specific commands to run when analyzing a malware sample

The scope, objectives, and governance of the SOC

The technical specifications of the SIEM platform

Information Systems Security Management Professional

Domain 4Objective 1

4.1 Establish and Maintain Security Operations Center ISSMP Practice Questions (Page 3)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

18%of the exam

Questions 11–15

11foundation · easy
Which type of SOC documentation defines the high-level rules and expectations for SOC behavior, such as acceptable use and escalation authority?
Select an answer first
12foundation · easy
Which of the following is a best practice for maintaining SOC documentation?
Select an answer first
13application · medium
A SOC manager is reviewing the SOC's documentation and finds that several playbooks reference outdated tools and processes that were replaced six months ago. The manager wants to prevent this from happening again. What should the manager implement?
Select an answer first
14foundation · easy
Which of the following tasks would most likely be documented in a SOC standard operating procedure?
Select an answer first
15foundation · easy
What should a SOC policy primarily define?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.