1.1 Demonstrate Understanding of SOC Components and Functions CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a typical tiered SOC structure, which tier is responsible for performing deep-dive analysis, such as correlating multiple data sources and determining the scope of a confirmed incident?

   • ATier 1
   • BTier 3
   • CTier 2
   • DSOC manager
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC wants to prioritize alerts based on the likelihood that a specific threat actor will target their industry. Which data source is most relevant for this prioritization?

   • AThreat intelligence feeds that include actor profiles and industry targeting.
   • BEndpoint detection and response (EDR) alerts.
   • CVulnerability scan results.
   • DNetwork flow logs.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC has a Tier 1 analyst who is consistently escalating alerts to Tier 2 that are later determined to be false positives. The Tier 2 team is becoming overwhelmed. Which process change would best address the root cause?

   • AIncrease the number of Tier 2 analysts to handle the extra workload.
   • BDisable the detection rules that are generating the false positives.
   • CRequire Tier 2 to document every false positive but continue the current escalation process.
   • DProvide the Tier 1 analyst with additional training on alert validation and update the triage runbook with clearer false-positive criteria.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC is looking for a tool that can block malicious network traffic in real time based on signatures and anomaly detection. Which tool category is designed for this purpose?

   • ASecurity information and event management (SIEM).
   • BIntrusion prevention system (IPS).
   • CData loss prevention (DLP).
   • DVulnerability scanner.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC team wants to automate the response to a known phishing campaign by automatically quarantining affected endpoints and blocking the malicious sender in the email gateway. Which tool category is designed to orchestrate this automated response?

   • AIntrusion detection system (IDS).
   • BData loss prevention (DLP).
   • CSecurity information and event management (SIEM).
   • DSecurity orchestration, automation, and response (SOAR).
   Reveal Solution Discussion Select an answer first