1.3 Explain the Common Components and Functions of a Security Operations Center (SOC) SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which SOC tool is primarily used to aggregate and correlate security event data from multiple sources to identify potential security incidents?

   • AIDS/IPS
   • BSIEM
   • CFirewall
   • DEDR
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SOC manager is designing a new shift structure. The SOC has 12 analysts: 6 Tier 1, 4 Tier 2, and 2 Tier 3. The manager wants to ensure that every shift has at least one Tier 1 and one Tier 2 analyst, and that Tier 3 is available on-call. Which shift structure best meets these requirements while maintaining coverage?

   • ATwo 12-hour shifts with 3 Tier 1 and 2 Tier 2 analysts per shift, with Tier 3 on-call.
   • BOne 24-hour shift with all 12 analysts on duty, with Tier 3 on-call.
   • CThree 8-hour shifts with 2 Tier 1 and 1 Tier 2 analysts per shift, with Tier 3 on-call.
   • DFour 6-hour shifts with 1 Tier 1 and 1 Tier 2 analyst per shift, with Tier 3 on-call.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC is investigating a series of alerts that appear to be coordinated across multiple hosts. The Tier 1 analyst on duty has identified the pattern but lacks the experience to determine the full scope. The Tier 2 analyst is busy with another incident. The SOC manager wants to leverage the most appropriate resource to analyze the pattern without disrupting the Tier 2 analyst's work. Which action is most appropriate?

   • AWait for the Tier 2 analyst to finish the current incident before investigating.
   • BEscalate the alert to Tier 3 immediately without further analysis.
   • CInstruct the Tier 1 analyst to perform the deep investigation independently.
   • DAssign the threat hunting team to investigate the pattern proactively.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A SOC is evaluating its tool stack. The SIEM generates alerts, but analysts must manually copy indicators into a separate threat intelligence platform to enrich them, and then manually block malicious IPs on the firewall. The SOC manager wants to reduce manual effort and improve response time. Which combination of tools would best address this workflow?

   • AReplace the SIEM with a more advanced EDR solution.
   • BIntegrate the SIEM with the threat intelligence platform and add a SOAR platform to automate enrichment and firewall blocking.
   • CAdd more Tier 1 analysts to perform the manual enrichment and blocking faster.
   • DUse the firewall's built-in threat intelligence feed instead of the separate platform.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In a SOC, what is the purpose of the alert triage process?

   • ATo generate reports for management
   • BTo determine the severity and priority of alerts and decide which require further investigation
   • CTo escalate all alerts to Tier 3 immediately
   • DTo automatically remediate all alerts without human review
   Reveal Solution Discussion Select an answer first