Summarize the Organization of a Typical SOC and the Tasks Belonging to Analyst, Engineer and Architect Roles. SPLK-5001 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Tier 1 SOC analyst is handling an alert for a potential data exfiltration from a file server. The analyst sees that a large amount of data was transferred to an external IP. The analyst also notices that the file server is used by multiple departments and that the transfer occurred during business hours. What is the most appropriate action for the analyst?

   • AContact the file server administrator to ask if the transfer was expected.
   • BClose the alert as a false positive because the transfer occurred during business hours.
   • CEscalate the alert to Tier 2 for investigation, noting the business context and the need to determine if the transfer was authorized.
   • DBlock the external IP address immediately to stop the potential exfiltration.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following best describes the primary difference between a SOC Architect and a SOC Engineer?

   • AArchitects perform threat hunting, while Engineers perform vulnerability scanning.
   • BArchitects are responsible for day-to-day monitoring, while Engineers are responsible for incident response.
   • CArchitects focus on designing the SOC's overall structure and processes, while Engineers focus on implementing and maintaining the technical components.
   • DArchitects manage the SOC team, while Engineers manage the security tools.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following tasks is most characteristic of a SOC Engineer rather than a SOC Analyst or SOC Architect?

   • APerforming initial triage on incoming security alerts
   • BDeploying and maintaining security monitoring tools such as SIEM and EDR
   • CConducting post-incident reviews and documenting lessons learned
   • DDefining the long-term strategic roadmap for the SOC
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A Tier 2 SOC analyst is investigating an alert that indicates a user's account was used to access a sensitive database at an unusual time. The analyst finds that the user is on vacation and has not logged in. The analyst also sees that the access originated from an IP address that is used by a third-party contractor. What is the most appropriate action for the analyst?

   • AContact the user to confirm if they gave the contractor access.
   • BTreat this as a potential account compromise and escalate to Tier 3 for a deeper forensic investigation.
   • CClose the alert as a false positive because the IP belongs to a known contractor.
   • DDisable the contractor's access to the database immediately.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A SOC architect is designing a SOC for a startup that has a limited budget but needs to provide 24/7 coverage. The architect must balance cost with the need for continuous monitoring. Which architectural approach best addresses this constraint?

   • AHire a large internal team to cover all shifts in-house.
   • BRely solely on automated tools and alerts without human monitoring.
   • COutsource the entire SOC to an MSSP with no internal oversight.
   • DDesign a tiered SOC with a small internal team for daytime coverage and a managed security service provider (MSSP) for after-hours monitoring.
   Reveal Solution Discussion Select an answer first