1.3 Define Security Operations Center (SOC) Performance Metrics and Reporting Requirements SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC is required to report to the board of directors on a quarterly basis. The board wants to understand the overall security posture and the SOC's contribution to the business. Which reporting format would be most appropriate?

   • AAn email with a list of all incidents and their details
   • BA high-level dashboard with key performance indicators (KPIs) and trend lines
   • CA verbal presentation with no written report
   • DA detailed technical report with all metrics and raw data
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When selecting SOC metrics, what should be the primary consideration?

   • AThe metrics that show the SOC in the most positive light
   • BThe metrics that are easiest to calculate from existing logs
   • CThe metrics that align with organizational goals and stakeholder needs
   • DThe metrics that are commonly used by other organizations in the industry
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which stakeholder group would most benefit from a report containing detailed metrics such as alert triage times and false positive rates?

   • AExternal auditors
   • BSOC analysts
   • CLegal counsel
   • DExecutives
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC analyst is preparing a report for the incident response team. The team wants to understand the effectiveness of their investigation processes. Which metric would be most relevant to include?

   • ANumber of alerts generated per day
   • BNumber of security incidents reported to the board
   • CPercentage of critical vulnerabilities remediated
   • DMean time to investigate (MTTI)
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which metric would be most appropriate to report to a stakeholder focused on reducing the impact of security incidents?

   • ATotal bytes of network traffic monitored
   • BNumber of security tools deployed
   • CPercentage of analysts with advanced certifications
   • DMean time to contain (MTTC)
   Reveal Solution Discussion Select an answer first