Summarize the Organization of a Typical SOC and the Tasks Belonging to Analyst, Engineer and Architect Roles. SPLK-5001 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC analyst discovers a series of alerts indicating that a legitimate internal application is making outbound connections to an IP address that is on a threat intelligence blocklist. The analyst verifies that the application is business-critical and that the IP is a shared hosting address that may also serve legitimate services. The analyst must decide how to handle the alerts without disrupting business operations. What is the most appropriate action?

   • AEscalate to Tier 3 for a full incident investigation and threat hunt.
   • BDocument the finding, mark the alerts as low priority, and recommend a review of the blocklist entry.
   • CImmediately block the IP address at the firewall to prevent potential compromise.
   • DDisable the correlation rule that generates these alerts to reduce noise.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Tier 1 SOC analyst is monitoring the SIEM dashboard and sees an alert for a user logging in from an unusual geographic location at 3:00 AM. The analyst checks the user's profile and sees they are a remote worker who frequently travels. The user has not been flagged by any other rule. What is the most appropriate action for the analyst?

   • ADisable the user's account to prevent further access.
   • BIgnore the alert because the user is a known traveler.
   • CMark the alert as a low-priority event and continue monitoring, noting it for the next shift.
   • DImmediately escalate to Tier 2 as a confirmed account compromise.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Tier 2 SOC analyst is investigating a confirmed malware infection on a server. The analyst has identified the malicious process and the files it created. According to typical SOC role definitions, which task is most appropriate for the Tier 2 analyst to perform?

   • AEscalate the incident to Tier 3 for initial triage.
   • BContain the threat by isolating the server and eradicating the malware from the system.
   • CClose the incident after documenting the findings without further action.
   • DDesign a new detection rule to identify similar malware in the future.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC analyst notices an alert for a single workstation attempting outbound connections to a known malicious IP. The alert fired at 2:00 AM, and the workstation user has not logged in since yesterday. The analyst checks the endpoint logs, confirms the connection was initiated by a scheduled task, and determines the file is quarantined. According to typical SOC tier structure, which action is most appropriate for this analyst to take next?

   • AClose the alert as a false positive because the file is already quarantined.
   • BContact the workstation user to ask if they installed the scheduled task.
   • CEscalate the incident to Tier 2 for deeper investigation and containment.
   • DRebuild the workstation immediately without further analysis.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC architect is planning a new SOC for a financial institution that must comply with strict data residency requirements. The architect needs to design the architecture to ensure that all security logs are stored within the country of operation. Which consideration is most important for the architect to address?

   • APurchasing dedicated hardware for the SIEM to ensure physical control.
   • BConfiguring the SIEM to forward all logs to a central headquarters in another country.
   • CSelecting a SIEM platform that supports data residency controls and can be deployed in a local region.
   • DHiring additional Tier 1 analysts to monitor the increased alert volume.
   Reveal Solution Discussion Select an answer first