6.2 Identify Methods to Optimize Security Operations Center (SOC) Performance (e.g., Automation and AI, Collaboration and Information Sharing, Regular Security Policy Updates, Security Framework Alignment) CYBERSECURITY-APPRENTICE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is collaboration among SOC team members important for incident response?

   • AIt allows only one analyst to handle all aspects of an incident
   • BIt ensures that different perspectives and expertise are applied to complex incidents
   • CIt eliminates the need for external threat intelligence
   • DIt reduces the need for documented procedures
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which benefit does AI provide in a SOC environment?

   • AIt automatically patches all vulnerabilities without human input
   • BIt guarantees that no false positives will occur
   • CIt can identify patterns in large volumes of data that might indicate a threat
   • DIt eliminates the need for human analysts entirely
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC team is considering implementing an AI-based alert triage system. The team is concerned about the potential for the AI to miss novel attacks that do not match known patterns. They also want to ensure that the system reduces false positives without increasing the risk of missing true positives. What is the most balanced approach?

   • AUse the AI only for reporting and continue manual triage for all alerts.
   • BFully automate all alert triage and rely on the AI to catch all threats.
   • CDisable the AI system after a trial period and return to manual triage.
   • DDeploy the AI system to handle low-confidence alerts while keeping high-confidence alerts for manual review.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a potential consequence of not regularly updating security policies?

   • AThe organization will be immune to all threats
   • BThere will be no impact as long as initial policies were strong
   • CThe SOC will automatically block all traffic
   • DSecurity controls may become ineffective against new attack methods
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC team wants to improve its detection capabilities by ensuring that its security tools are aligned with known adversary behaviors. Which framework would be most useful for this purpose?

   • AMITRE ATT&CK, to map detection rules to specific adversary techniques.
   • BCOBIT, to govern IT management and align IT with business goals.
   • CISO 27001, to establish an information security management system.
   • DITIL, to manage IT services and improve service delivery.
   Reveal Solution Discussion Select an answer first