1.3 Explain the Common Components and Functions of a Security Operations Center (SOC) SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   A SOC analyst is reviewing an alert from a behavioral analytics rule that flags a service account running a PowerShell script at 3:00 AM. The analyst checks the threat intelligence platform and finds no known indicators associated with the script. What is the most appropriate next step?

   • AEscalate the alert to Tier 2 for investigation, as the behavior is anomalous and could indicate compromise.
   • BDisable the behavioral analytics rule for the service account.
   • CIgnore the alert and monitor the account for 24 hours.
   • DClose the alert as a false positive because no threat intelligence indicators match.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which SOC process involves documenting the actions taken during an incident and communicating findings to stakeholders?

   • AAlert triage
   • BEscalation
   • CReporting
   • DIncident handling
   Reveal Solution Discussion Select an answer first