6.2 Identify Methods to Optimize Security Operations Center (SOC) Performance (e.g., Automation and AI, Collaboration and Information Sharing, Regular Security Policy Updates, Security Framework Alignment) CYBERSECURITY-APPRENTICE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A SOC manager is planning the annual security policy update cycle. The team has limited resources and cannot update all policies at once. The manager wants to prioritize updates that will have the most significant impact on security. Which approach should the manager take?

   • AUpdate only the policies that are easiest to change to save time.
   • BUpdate policies in alphabetical order to ensure all are reviewed equally.
   • CPrioritize updates based on the latest threat intelligence and the organization's risk assessment.
   • DWait until a major incident occurs to identify which policies need updating.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC team conducts quarterly reviews of its security policies. During a review, they find that some policies are outdated and do not reflect the current threat landscape. What is the best practice to ensure policies remain effective?

   • AOnly update policies when a major incident occurs.
   • BKeep policies unchanged to maintain stability and avoid introducing new errors.
   • CUpdate policies based on recent threat intelligence and lessons learned from incidents.
   • DCopy policies from a similar organization to ensure best practices are followed.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How does aligning SOC operations with a framework like MITRE ATT&CK improve performance?

   • AIt guarantees that all attacks will be detected immediately
   • BIt eliminates the need for security monitoring tools
   • CIt replaces the need for incident response procedures
   • DIt provides a common language for describing adversary behaviors
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A SOC team wants to reduce the time analysts spend on repetitive, low-level alert triage. Which approach best addresses this goal?

   • ADisabling all alert notifications to avoid distractions
   • BAutomating routine alert enrichment and initial triage with playbooks
   • CIncreasing the number of manual review steps for every alert
   • DAssigning all alerts to a single senior analyst for review
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC team receives a high volume of alerts from multiple sources, making it difficult to prioritize responses. The team wants to implement a solution that automatically aggregates and prioritizes alerts based on severity and potential impact. What should they implement?

   • AA spreadsheet that lists all alerts and their sources for analysts to sort through.
   • BA security orchestration, automation, and response (SOAR) platform that ingests alerts and applies playbooks for triage.
   • CA firewall rule that blocks all traffic from IP addresses that generate more than five alerts per hour.
   • DA manual process where each analyst reviews all alerts and assigns a priority level.
   Reveal Solution Discussion Select an answer first