6.2 Identify Methods to Optimize Security Operations Center (SOC) Performance (e.g., Automation and AI, Collaboration and Information Sharing, Regular Security Policy Updates, Security Framework Alignment) CYBERSECURITY-APPRENTICE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC team is considering automating its incident response playbooks. However, the team is concerned about the risk of automated actions causing unintended damage, such as blocking a critical business application. What is the best way to mitigate this risk?

   • AFully automate all actions to ensure the fastest possible response.
   • BOnly automate actions that are reversible, such as quarantining emails.
   • CDisable automation and rely on manual response to avoid any risk.
   • DImplement automated playbooks with human approval checkpoints for high-impact actions.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A SOC team is part of a multinational corporation that must comply with strict data privacy regulations. They want to share threat intelligence with external partners but are concerned about exposing sensitive data. What is the most appropriate way to share information while maintaining compliance?

   • AShare full incident details, including any personal data, to ensure partners have complete context.
   • BRefuse to share any information with external partners to avoid compliance risks.
   • CShare anonymized and sanitized IOCs that do not contain personal or sensitive data.
   • DShare information only through informal channels, such as personal email, to avoid formal compliance requirements.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC team discovers a new malware variant during an incident. The team wants to help other organizations protect themselves and also gain more insight into the malware's behavior. What is the most effective action?

   • AUpdate the firewall rules to block the malware's command-and-control IP addresses.
   • BDelete all samples and logs to prevent the malware from spreading.
   • CPublish a detailed analysis and IOCs to a trusted threat intelligence sharing platform.
   • DKeep the findings internal to avoid alerting the threat actor.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC manager wants to improve the team's incident response consistency and ensure that all analysts follow a standardized process. The team currently handles incidents in an ad-hoc manner, leading to inconsistent outcomes. Which approach would best address this issue?

   • ACreate a shared folder with past incident reports for analysts to reference.
   • BIncrease the frequency of team meetings to discuss incidents after they occur.
   • CAdopt the NIST incident response framework and map current procedures to its phases.
   • DAssign each analyst a personal checklist to use during incidents.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A SOC team is part of a large enterprise with multiple business units. Each unit has its own security tools and processes, leading to inconsistent incident handling. The team wants to standardize incident response across the organization. What is the most effective approach?

   • ACreate a new tool that each unit can use independently without a common process.
   • BDevelop a centralized incident response plan based on a recognized framework and require all units to follow it.
   • COutsource incident response to a third-party provider to ensure consistency.
   • DAllow each unit to keep its own processes but share incident reports after the fact.
   Reveal Solution Discussion Select an answer first