4.1 Establish and Maintain Security Operations Center ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A regional bank is establishing a SOC to monitor its payment systems and customer-facing applications. The board has approved the budget, and the SOC manager must now define the SOC's authority and boundaries. Which document should the SOC manager create FIRST to ensure the SOC has clear scope and governance?

   • AA list of key performance indicators (KPIs) for measuring SOC effectiveness.
   • BA standard operating procedure for daily log review and alert triage.
   • CA SOC charter that defines the mission, scope, authority, and governance structure.
   • DA detailed incident response playbook for handling ransomware attacks.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC is creating a playbook for handling a distributed denial-of-service (DDoS) attack. The playbook must be effective during a real attack. Which element is MOST important to include?

   • AThe SOC's mission statement and objectives.
   • BA detailed history of past DDoS attacks on the organization.
   • CA list of all employees who might be affected by the DDoS attack.
   • DClear decision points that guide the analyst on when to escalate or take specific actions.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC manager is implementing a documentation maintenance process. The manager wants to ensure that documentation is updated promptly when changes occur, but also wants to avoid constant, disruptive updates. What is the BEST approach?

   • AUse a change management process that triggers documentation updates whenever a significant change is approved.
   • BUpdate documentation immediately after every minor change.
   • CAssign a dedicated documentation manager to update documents on an ad hoc basis.
   • DUpdate documentation only during the annual review.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC team has been receiving alerts from a new EDR platform, but analysts are handling them inconsistently. Some analysts escalate immediately, while others investigate for hours before escalating. The SOC manager needs to standardize the initial response to these alerts. What should the SOC manager implement?

   • AA policy that mandates all EDR alerts be escalated within 15 minutes.
   • BA playbook that outlines the response to a specific type of malware detected by the EDR.
   • CA new alert rule that reduces the number of EDR alerts generated.
   • DA standard operating procedure that defines the steps for triaging and escalating EDR alerts.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC manager has implemented a new SIEM platform and updated the corresponding playbooks. However, the manager is concerned that other documentation, such as SOPs and policies, may still reference the old SIEM. What should the manager do to ensure all documentation is consistent?

   • AWait until the next scheduled review cycle to update the documentation.
   • BConduct a full review of all SOC documentation to identify and update any references to the old SIEM.
   • COnly update the playbooks that were directly affected by the SIEM change.
   • DCreate a new policy that states all documentation is current.
   Reveal Solution Discussion Select an answer first