CCP SOC Operations & Alert Triage 2 — Questions and Answers
Question 1: An analyst receives an alert for a high volume of DNS queries to a single external domain from one internal host. What is the MOST likely threat to investigate first?
- DNS amplification attack
- DNS tunneling for data exfiltration (Correct answer)
- BGP route hijacking
- ARP spoofing
Correct answer: DNS tunneling for data exfiltration
High-frequency DNS queries to a single domain from one host is a classic indicator of DNS tunneling used for covert data exfiltration.
Question 2: Which metric is MOST useful for measuring the efficiency of a SOC's alert handling process?
- Number of alerts generated per day
- Mean Time to Detect (MTTD) (Correct answer)
- Total bandwidth consumed by SIEM
- Number of analysts on shift
Correct answer: Mean Time to Detect (MTTD)
Mean Time to Detect (MTTD) measures how quickly a SOC identifies a threat, directly reflecting detection efficiency.
Question 3: A SOC analyst observes repeated failed login attempts followed by one successful login from the same IP. What triage step should be performed FIRST?
- Block the source IP immediately
- Check if the successful login belongs to an authorized user (Correct answer)
- Escalate directly to incident response
- Ignore since a login eventually succeeded
Correct answer: Check if the successful login belongs to an authorized user
Verifying whether the successful login is from a legitimate user determines if a credential stuffing or brute-force attack succeeded.
Question 4: In a SOC workflow, what is the purpose of a playbook?
- To document lessons learned after an incident
- To provide step-by-step response procedures for specific alert types (Correct answer)
- To configure firewall rules automatically
- To store raw log data for forensic analysis
Correct answer: To provide step-by-step response procedures for specific alert types
Playbooks provide standardized, step-by-step procedures analysts follow when responding to specific types of security alerts.
Question 5: Which of the following BEST describes a 'true positive' in SOC alert triage?
- An alert triggered by normal authorized activity
- An alert that correctly identifies actual malicious activity (Correct answer)
- A threat that was not detected by any security tool
- A benign event that generates no alert
Correct answer: An alert that correctly identifies actual malicious activity
A true positive is an alert that accurately flags genuine malicious or unauthorized activity requiring analyst attention.
Question 6: A SOC team wants to reduce alert fatigue. Which approach is MOST effective?
- Increase the sensitivity of all detection rules
- Tune SIEM rules to suppress known benign events (Correct answer)
- Add more analysts to handle the volume
- Disable alerts below critical severity
Correct answer: Tune SIEM rules to suppress known benign events
Tuning SIEM rules to filter out known benign patterns reduces noise so analysts focus on genuine threats.
Question 7: Which log source is MOST valuable for detecting lateral movement within a Windows environment?
- Web proxy logs
- Windows Security Event Logs (Event ID 4624/4648) (Correct answer)
- DHCP server logs
- DNS resolver cache
Correct answer: Windows Security Event Logs (Event ID 4624/4648)
Windows Security Event IDs 4624 (logon) and 4648 (explicit credential use) capture authentication events critical for detecting lateral movement.
CCP SOC Operations & Alert Triage 2
An analyst receives an alert for a high volume of DNS queries to a single external domain from one internal host.
What is the MOST likely threat to investigate first?