1.3 Explain the Common Components and Functions of a Security Operations Center (SOC) SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC is investigating a suspected malware infection on a laptop. The analyst needs to determine which processes executed on the endpoint and whether any files were modified in the last 24 hours. Which tool provides the most direct visibility into this endpoint activity?

   • ANetwork firewall logs
   • BSIEM correlation rules
   • CThreat intelligence platform
   • DEDR agent installed on the laptop
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In a typical SOC, which role is primarily responsible for proactively searching for advanced threats that may have evaded existing security controls?

   • ASOC manager
   • BThreat hunter
   • CIncident responder
   • DSOC analyst
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC is hiring new analysts. The manager wants to ensure that complex investigations that require deep packet analysis and malware reverse engineering are handled by the most senior staff. Which tier should be assigned this responsibility?

   • AThreat hunting team
   • BTier 1 analysts
   • CTier 3 analysts
   • DTier 2 analysts
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Tier 1 analyst receives an alert for multiple failed login attempts followed by a successful login on a privileged account. The analyst verifies the successful login originated from an unusual geographic location. According to standard SOC escalation workflow, what should the analyst do?

   • AClose the alert as a false positive because the login was successful.
   • BReset the user's password and close the alert.
   • CEscalate the alert to Tier 2 with the context of the failed attempts and the unusual location.
   • DBlock the user's account and notify the user's manager.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Tier 1 analyst receives an alert for a single failed login attempt on a user account. The analyst checks the SIEM and sees no other related activity. According to standard SOC triage workflow, what is the most appropriate next step?

   • ABlock the user's account until the source IP is investigated.
   • BReset the user's password immediately as a precaution.
   • CClose the alert as a low-priority event and document the reasoning in the ticket.
   • DEscalate the alert to Tier 2 for immediate investigation.
   Reveal Solution Discussion Select an answer first