1.3 Explain the Common Components and Functions of a Security Operations Center (SOC) SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After a confirmed phishing incident, a SOC analyst uses the SOAR platform to automatically block the sender's domain across the email gateway and firewall. The analyst also creates a ticket with the full timeline of events. Which SOC process is being demonstrated?

   • AIncident response and reporting
   • BSecurity awareness training
   • CVulnerability management
   • DThreat hunting
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC manager is reviewing the workload distribution across the team. Tier 1 analysts are spending most of their shift manually correlating raw log data from multiple sources to determine whether low-severity alerts warrant escalation. The manager wants to reallocate Tier 1 effort toward active monitoring and initial triage. Which adjustment best addresses the workflow inefficiency?

   • AInstruct Tier 1 analysts to escalate all low-severity alerts to Tier 2 for faster resolution.
   • BReduce the number of monitored data sources to lower the volume of raw logs Tier 1 must review.
   • CAssign the threat hunting team to perform all initial alert triage instead of Tier 1.
   • DImplement a SIEM correlation rule that aggregates related events and enriches alerts with context before they reach Tier 1.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC's signature-based IDS is generating a high rate of false positives because the organization recently deployed a new application that uses non-standard ports. The SOC manager wants to maintain detection of actual threats while reducing noise. Which approach best balances detection coverage and alert quality?

   • AIncrease the alert threshold so only high-volume traffic triggers the signatures.
   • BDisable the affected IDS signatures until the application is fully documented.
   • CMove the new application to a separate network segment and ignore its traffic in the IDS.
   • DTune the IDS signatures to exclude the new application's known traffic patterns while keeping the signatures active for other traffic.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC manager is reviewing the team's performance after a quarter. The manager notices that Tier 1 analysts are frequently escalating alerts to Tier 2 without performing basic enrichment, and Tier 2 is overwhelmed. The manager also observes that the threat hunting team is underutilized. Which change best addresses the workflow imbalance while respecting role boundaries?

   • AReassign the threat hunting team to assist Tier 2 with escalated investigations.
   • BImplement a mandatory triage checklist in the SIEM that requires Tier 1 to complete basic enrichment before escalation is allowed.
   • CAutomatically escalate all Tier 1 alerts to Tier 2 after 15 minutes.
   • DIncrease the number of Tier 2 analysts to handle the escalation volume.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which SOC role is typically responsible for leading the response to a confirmed security incident, coordinating actions, and ensuring containment and remediation?

   • AIncident responder
   • BSOC analyst
   • CSOC manager
   • DThreat hunter
   Reveal Solution Discussion Select an answer first