6.2 Identify Methods to Optimize Security Operations Center (SOC) Performance (e.g., Automation and AI, Collaboration and Information Sharing, Regular Security Policy Updates, Security Framework Alignment) CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does sharing threat intelligence with external organizations benefit a SOC?

   • AIt provides early warning about emerging threats and attack techniques
   • BIt eliminates the need for internal monitoring
   • CIt allows organizations to share sensitive customer data freely
   • DIt guarantees that all attacks will be prevented
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's SOC uses a set of security policies that were last updated six months ago. Recently, the team noticed an increase in alerts related to a new type of ransomware that exploits a vulnerability in a commonly used application. What is the most appropriate initial action?

   • ADisable the affected application until the vendor releases a patch.
   • BUpdate the security policies to include detection rules and prevention measures for the new ransomware and the exploited vulnerability.
   • CWait for the next scheduled policy review in six months to incorporate the new threat.
   • DIncrease the alert threshold for the application to reduce the number of alerts.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC analyst spends several hours each day manually correlating alerts from multiple security tools and creating tickets for each confirmed incident. The team lead wants to reduce this repetitive workload so analysts can focus on investigating complex threats. Which approach best addresses this need?

   • ARequire analysts to document every alert in a shared spreadsheet before creating tickets.
   • BImplement an orchestration tool that automatically enriches alerts, correlates related events, and creates incident tickets based on predefined rules.
   • CIncrease the number of analysts on the team to distribute the manual correlation and ticket creation workload.
   • DDisable low-priority alerts to reduce the volume of alerts that need correlation.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC team is investigating a phishing campaign that uses a newly observed domain. The team has limited context about the threat actor's infrastructure. Which action would most effectively enhance their understanding and response?

   • AIncrease the alert severity for all phishing emails to ensure they are reviewed faster.
   • BShare indicators of compromise (IOCs) with an industry information-sharing group and check for any related threat intelligence.
   • CWait for the next scheduled security policy update before taking any action.
   • DBlock the domain in the firewall and close the investigation without further analysis.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC manager wants to measure the team's performance and identify areas for improvement. The team currently does not use any formal framework. Which action would best help the manager achieve this goal?

   • AAsk each analyst to self-report their productivity at the end of each week.
   • BAdopt the MITRE ATT&CK framework to categorize and track detection and response coverage.
   • CIncrease the number of alerts handled per day as the primary performance metric.
   • DCompare the team's performance to a neighboring company's SOC.
   Reveal Solution Discussion Select an answer first