A SOC manager is developing a policy for the SOC. The policy must define the SOC's objectives and governance. Which element is essential to include in this policy?

The SOC's mission, scope, and the authority granted to the SOC team.

The maintenance schedule for the SOC's documentation.

The names of all SOC analysts and their shift schedules.

The specific commands to use when investigating a malware infection.

A SOC manager is creating a standard operating procedure for incident escalation. The manager wants to ensure that the procedure is actionable and clear. Which element is MOST important to include in the SOP?

A list of all possible incident types and their severity ratings.

The SOC's mission statement and objectives.

A general statement that incidents should be escalated promptly.

Specific criteria for when to escalate and the contact information for each escalation level.

A multinational corporation is establishing a SOC that will monitor operations across multiple regions. The SOC manager needs to ensure that the SOC's authority is recognized across all regional business units and that the SOC can enforce its decisions. What should the SOC manager do?

Create detailed playbooks for each regional threat landscape.

Develop a SOC charter that is approved by executive leadership and clearly defines the SOC's authority and governance.

Implement a ticketing system that tracks all SOC actions.

Hire additional analysts to cover all time zones.

A SOC manager is explaining the purpose of SOC documentation to a new analyst. The analyst asks why the SOC needs both policies and playbooks. What is the BEST explanation?

Policies define the high-level expectations and governance, while playbooks provide the step-by-step response for specific incidents.

Policies are updated annually, and playbooks are updated monthly.

Policies are for management, and playbooks are for analysts.

Policies are optional, and playbooks are mandatory.

A SOC manager is developing a policy for the SOC. The policy must be enforceable and practical. Which approach is BEST?

Keep the policy vague to allow for flexibility in interpretation.

Make the policy as strict as possible to ensure maximum security.

Involve stakeholders from across the organization in the policy development process.

Write the policy based on industry best practices without consulting internal stakeholders.

Information Systems Security Management Professional

Domain 4Objective 1

4.1 Establish and Maintain Security Operations Center ISSMP Practice Questions (Page 4)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

18%of the exam

Questions 16–20

16application · medium
A SOC manager is developing a policy for the SOC. The policy must define the SOC's objectives and governance. Which element is essential to include in this policy?
Select an answer first
17application · medium
A SOC manager is creating a standard operating procedure for incident escalation. The manager wants to ensure that the procedure is actionable and clear. Which element is MOST important to include in the SOP?
Select an answer first
18application · medium
A multinational corporation is establishing a SOC that will monitor operations across multiple regions. The SOC manager needs to ensure that the SOC's authority is recognized across all regional business units and that the SOC can enforce its decisions. What should the SOC manager do?
Select an answer first
19application · medium
A SOC manager is explaining the purpose of SOC documentation to a new analyst. The analyst asks why the SOC needs both policies and playbooks. What is the BEST explanation?
Select an answer first
20expert · hard
A SOC manager is developing a policy for the SOC. The policy must be enforceable and practical. Which approach is BEST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.