Summarize the Organization of a Typical SOC and the Tasks Belonging to Analyst, Engineer and Architect Roles. SPLK-5001 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a typical SOC organizational chart, which role is most likely to have direct managerial responsibility for the SOC analysts?

   • AIncident Response Lead
   • BSOC Architect
   • CSOC Engineer
   • DSOC Manager
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A SOC Architect is tasked with improving the SOC's ability to detect advanced threats. Which of the following actions is most aligned with the Architect's role?

   • AManually analyzing a suspicious network traffic capture
   • BDefining a threat hunting methodology and integrating it into the SOC's operational processes
   • CUpdating the SIEM's correlation rules to detect a new malware signature
   • DResponding to a confirmed incident and containing the threat
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC engineer is responsible for maintaining the SIEM's correlation rules. The engineer notices that a rule for detecting lateral movement is generating a high number of false positives due to legitimate admin activity. The engineer must reduce false positives without missing real lateral movement. What is the most appropriate engineering action?

   • ARefine the rule to exclude known admin accounts and add a threshold for the number of connections.
   • BDisable the rule until the false positives are resolved.
   • CIncrease the severity of the rule to ensure analysts pay more attention.
   • DAsk the SOC architect to redesign the entire detection strategy.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC engineer is tasked with automating the response to a common alert: a workstation beaconing to a known C2 domain. The engineer wants to ensure that the automation does not disrupt legitimate business operations. Which approach best balances automation with safety?

   • ADisable the alert rule to prevent future false positives.
   • BCreate a playbook that isolates the host from the network and notifies the analyst for confirmation.
   • CAutomatically shut down the host without any analyst notification.
   • DAutomatically delete the scheduled task on the host without further action.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC engineer is asked to implement a new SOAR platform to automate incident response. The engineer must ensure that the automation does not violate compliance requirements that mandate human approval for certain actions, such as account disabling. What is the most appropriate engineering approach?

   • ADesign the SOAR playbooks to require manual approval for high-impact actions like account disabling.
   • BAutomate all actions, including account disabling, to maximize efficiency.
   • CSkip the SOAR implementation and continue with manual processes.
   • DAsk the SOC architect to redesign the compliance policy.
   Reveal Solution Discussion Select an answer first