Summarize the Organization of a Typical SOC and the Tasks Belonging to Analyst, Engineer and Architect Roles. SPLK-5001 Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A SOC engineer is asked to integrate a new threat intelligence feed into the SIEM. The engineer needs to ensure that the feed is used to enrich alerts without overwhelming the system. What is the most appropriate engineering approach?

   • AConfigure the SIEM to correlate the threat intelligence feed with incoming events and add context to alerts.
   • BAsk the analysts to check the threat intelligence feed manually when investigating alerts.
   • CManually add the threat intelligence indicators to every existing correlation rule.
   • DDisable all existing correlation rules until the new feed is fully tested.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a primary responsibility of a SOC Architect?

   • AMonitoring security alerts and performing initial triage
   • BDeploying and configuring security tools
   • CDesigning the SOC's architecture, including the selection of security tools and technologies
   • DManaging the SOC team and handling personnel issues
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a typical task performed by a SOC Engineer?

   • ADefining the SOC's overall security strategy and architecture
   • BPerforming initial triage on incoming security alerts
   • CManaging the SOC team and conducting performance reviews
   • DTuning and maintaining the SIEM correlation rules to reduce false positives
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SOC engineer is responsible for maintaining the SIEM platform. The engineer notices that the SIEM is running out of storage space, which is causing delays in log ingestion. What is the most appropriate engineering task to address this issue?

   • AAsk the SOC manager to reduce the number of alerts generated.
   • BDisable log collection from non-critical sources to save space.
   • CEscalate to the architect to redesign the entire SIEM architecture.
   • DIncrease the storage capacity and implement a log retention policy to manage data growth.
   Reveal Solution Discussion Select an answer first