CCP SOC Operations & Alert Triage 2

Question 1

An analyst receives an alert for a high volume of DNS queries to a single external domain from one internal host. What is the MOST likely threat to investigate first?

Accepted Answer

DNS tunneling for data exfiltration

Answer

High-frequency DNS queries to a single domain from one host is a classic indicator of DNS tunneling used for covert data exfiltration.

Question 2

Which metric is MOST useful for measuring the efficiency of a SOC's alert handling process?

Accepted Answer

Mean Time to Detect (MTTD)

Answer

Mean Time to Detect (MTTD) measures how quickly a SOC identifies a threat, directly reflecting detection efficiency.

Question 3

A SOC analyst observes repeated failed login attempts followed by one successful login from the same IP. What triage step should be performed FIRST?

Accepted Answer

Check if the successful login belongs to an authorized user

Answer

Verifying whether the successful login is from a legitimate user determines if a credential stuffing or brute-force attack succeeded.

Question 4

In a SOC workflow, what is the purpose of a playbook?

Accepted Answer

To provide step-by-step response procedures for specific alert types

Answer

Playbooks provide standardized, step-by-step procedures analysts follow when responding to specific types of security alerts.

Question 5

Which of the following BEST describes a 'true positive' in SOC alert triage?

Accepted Answer

An alert that correctly identifies actual malicious activity

Answer

A true positive is an alert that accurately flags genuine malicious or unauthorized activity requiring analyst attention.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP SOC Operations & Alert Triage 2