Summarize the Organization of a Typical SOC and the Tasks Belonging to Analyst, Engineer and Architect Roles. SPLK-5001 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In a typical Security Operations Center (SOC) organizational structure, which statement best describes the relationship between Tier 1 and Tier 2 analysts?

   • ATier 1 analysts report directly to Tier 2 analysts, who handle all escalations and final decisions.
   • BTier 1 analysts perform initial monitoring and triage, escalating more complex or confirmed incidents to Tier 2 analysts for deeper investigation.
   • CTier 2 analysts are responsible for initial monitoring, while Tier 1 analysts focus solely on threat hunting and proactive detection.
   • DTier 1 and Tier 2 analysts have identical responsibilities and rotate shifts to cover 24/7 operations.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A SOC Engineer is asked to reduce the time analysts spend on repetitive tasks. Which of the following actions is most aligned with the SOC Engineer's role?

   • ATraining analysts on how to use the SIEM platform
   • BConducting a risk assessment of the organization's critical assets
   • CCreating automated playbooks that enrich alerts with threat intelligence data
   • DReviewing the SOC's incident response procedures and recommending changes
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC architect is designing a new SOC and must decide how to organize the team to handle a high volume of alerts while ensuring that complex incidents receive sufficient attention. Which organizational structure best addresses this requirement?

   • AImplement a tiered structure with Tier 1 handling triage, Tier 2 handling investigation, and Tier 3 handling advanced analysis.
   • BAssign all alerts to the most senior analyst to ensure quality.
   • COutsource all alert handling to a third-party MSSP without internal oversight.
   • DUse a single team of generalists who handle all alerts from start to finish.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A Tier 1 SOC analyst is reviewing a queue of alerts. One alert indicates a potential brute-force attack on a VPN gateway, and another indicates a single failed login for a standard user. The analyst has limited time. Which alert should the analyst prioritize?

   • ANeither alert, as they are both likely false positives.
   • BThe single failed login, as it may indicate a user error.
   • CBoth alerts equally, as they are both authentication-related.
   • DThe brute-force attack on the VPN gateway, as it indicates a higher-impact threat.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC engineer is asked to reduce the number of false positives from a newly deployed SIEM correlation rule. The rule currently triggers on any outbound connection to a known-bad IP. Analysts report that the rule fires repeatedly for the same infected host even after the host is cleaned. What is the most effective task for the SOC engineer to perform?

   • AEscalate the issue to the SOC architect to redesign the entire SIEM deployment.
   • BModify the correlation rule to suppress duplicate alerts for the same host within a 24-hour window.
   • CDisable the correlation rule entirely until the host is rebuilt.
   • DAsk the analysts to manually close duplicate alerts as false positives.
   Reveal Solution Discussion Select an answer first