Explain the Different Types of Analyst Performance Metrics Such as MTTR and Dwell Time. SPLK-5001 Practice Questions (Page 4)

Questions 16–18

1. 16expert · hard

   A SOC is evaluating the performance of its analysts. The team has a high MTTR, but the dwell time is low. The manager suspects that analysts are spending too much time on low-priority alerts, delaying response to critical incidents. Which additional metric would best help the manager confirm this hypothesis?

   • AMean Time to Detect (MTTD)
   • BAlert volume
   • CFalse positive rate
   • DMean Time to Contain (MTTC)
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC manager wants to measure how quickly analysts respond to confirmed security incidents after they are alerted. Which metric should the manager use to evaluate this specific aspect of analyst performance?

   • AMean Time to Respond (MTTR)
   • BFalse positive rate
   • CDwell time
   • DMean Time to Detect (MTTD)
   Reveal Solution Discussion Select an answer first
3. 18expert · hard

   A SOC manager is reviewing monthly metrics and notices that MTTR has decreased, but dwell time has increased. The team has been focusing on faster response procedures. What is the most likely explanation for this trend?

   • AThe team is responding faster, but detection is becoming slower.
   • BThe team is detecting incidents faster, but response is becoming slower.
   • CThe metrics are unrelated and the trend is coincidental.
   • DThe team is detecting incidents later, so they have less time to respond.
   Reveal Solution Discussion Select an answer first