1.3 Define Security Operations Center (SOC) Performance Metrics and Reporting Requirements SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How can SOC metrics drive continuous improvement?

   • ABy justifying the need for more security tools
   • BBy identifying trends and areas for optimization
   • CBy replacing the need for regular security assessments
   • DBy proving that the SOC is always effective
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC is selecting metrics to report to the IT operations team, which is responsible for maintaining the infrastructure. Which metric would be most relevant for this audience?

   • APercentage of alerts triaged within SLA
   • BPercentage of critical vulnerabilities remediated within SLA
   • CMean time to detect (MTTD) for critical alerts
   • DNumber of security incidents reported to the board
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC manager wants to use metrics to identify areas for improvement in the SOC's detection capabilities. Which approach would be most effective?

   • AReduce the number of alerts reported to management
   • BIncrease the number of detection rules to cover more threats
   • CAnalyze the false positive rate to identify detection rules that are generating excessive noise
   • DFocus only on the mean time to respond (MTTR)
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A large enterprise SOC needs to report on its performance to different audiences. The CISO wants a high-level overview of the SOC's effectiveness, while the incident response team lead wants detailed metrics on investigation times. What is the most appropriate way to structure the reporting?

   • ACreate two separate reports: a summary for the CISO and a detailed report for the team lead
   • BProvide the CISO with the detailed report and the team lead with a summary
   • CSend the same detailed report to both audiences to ensure consistency
   • DOnly report metrics that are relevant to the CISO to avoid confusion
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A SOC manager is reviewing the SOC's metrics and notices that the mean time to detect (MTTD) has decreased, but the mean time to respond (MTTR) has increased. The manager wants to use these metrics to drive continuous improvement. Which action would be most effective?

   • AInvestigate the cause of the increased MTTR, such as bottlenecks in the response process or resource constraints
   • BReplace MTTR with a different metric that is easier to improve
   • CIncrease the MTTR target to make the metric look better
   • DCelebrate the decrease in MTTD and ignore the increase in MTTR
   Reveal Solution Discussion Select an answer first