1.3 Explain the Common Components and Functions of a Security Operations Center (SOC) SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC operates a 24/7 follow-the-sun model with three regional teams. A Tier 1 analyst on the Asia-Pacific shift identifies a suspicious outbound data transfer that matches a known exfiltration pattern. The analyst escalates it to Tier 2, but the regional Tier 2 analyst is occupied with a critical incident. What is the most appropriate escalation action for the Tier 1 analyst?

   • AAttempt to contain the exfiltration directly by isolating the host from the network.
   • BWait until the regional Tier 2 analyst finishes the critical incident before escalating.
   • CEscalate the alert to the Tier 2 queue and notify the SOC manager on duty to coordinate coverage.
   • DClose the alert as a false positive since the Tier 2 analyst is unavailable.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   During a ransomware incident, a Tier 1 analyst identifies the affected hosts and escalates to Tier 2. The Tier 2 analyst begins containment by isolating the hosts. Meanwhile, the SOC manager is preparing a communication for executive leadership. Which workflow element is most at risk of being neglected during this high-pressure incident?

   • AEscalation of the incident to Tier 3
   • BMonitoring for additional affected hosts
   • CDocumentation of all actions taken and their timestamps
   • DCommunication with the affected users
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC analyst notices that the SIEM is generating a high volume of alerts for a known benign software update that occurs nightly across all workstations. The signature-based rule is triggering on the update's network traffic. Which action best reduces alert fatigue while maintaining detection coverage?

   • ARoute all alerts from this rule directly to the threat hunting team.
   • BIncrease the alert severity so the analyst notices it more clearly.
   • CDisable the signature-based rule entirely to stop the alerts.
   • DCreate an exception or suppression rule for the specific benign software update pattern.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which detection method is most effective at identifying previously unknown threats by establishing a baseline of normal behavior and flagging deviations?

   • AThreat intelligence
   • BSignature-based detection
   • CBehavioral analytics
   • DRule-based detection
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC analyst is reviewing an alert generated by a behavioral analytics rule that flags a user accessing files at an unusual time of day. The user's manager confirms the user is working a late shift this week. What is the most appropriate action?

   • AClose the alert as a false positive and document the manager's confirmation.
   • BDisable the behavioral analytics rule for this user.
   • CEscalate the alert to Tier 3 for a deep investigation.
   • DPlace the user's account under enhanced monitoring for 30 days.
   Reveal Solution Discussion Select an answer first