CSOC Security Operations Procedures 2

Question 1

What is 'Security Orchestration, Automation, and Response' (SOAR) in CSOC operations?

Accepted Answer

Technology that automates repetitive security tasks, integrates different security tools, and orchestrates incident response workflows to improve speed and efficiency

Answer

SOAR platforms automate routine, repetitive tasks such as alert enrichment, notification, and simple response actions, freeing analysts to focus on higher-value investigation and decision-making. They also integrate disparate security tools into unified workflows.

Question 2

What is the 'kill chain' framework in cybersecurity operations?

Accepted Answer

A model describing the stages of a cyber attack from reconnaissance through to data exfiltration, used to understand and disrupt attacks at each stage

Answer

The cyber kill chain describes the sequential stages of a cyber attack: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Understanding the kill chain helps defenders identify opportunities to detect and disrupt attacks at each stage.

Question 3

Under Singapore's regulatory framework, which CSOC-related obligation do operators of Critical Information Infrastructure (CII) have under the Cybersecurity Act?

Accepted Answer

CII owners must comply with mandatory cybersecurity standards and audits, and are required to report prescribed cybersecurity incidents to CSA

Answer

Under the Cybersecurity Act, CII owners face enhanced obligations including mandatory compliance with codes of practice, regular cybersecurity audits, incident reporting requirements, and participation in cybersecurity exercises as directed by CSA.

Question 4

What is 'threat modelling' and how is it used in security operations planning?

Accepted Answer

A structured process for identifying potential threats, attack vectors, and adversaries relevant to a specific system or organisation to inform defensive priorities

Answer

Threat modelling systematically identifies who might attack a system, what they want to achieve, how they might do it, and what the impact would be. This informs the prioritisation of security controls and monitoring activities to address the most relevant threats.

Question 5

What is the purpose of tabletop exercises in a CSOC environment?

Accepted Answer

To simulate cybersecurity incidents in a discussion-based format, testing and improving the team's response plans, decisions, and coordination without impacting real systems

Answer

Tabletop exercises are scenario-based discussions where participants walk through their response to a simulated incident. They test decision-making, expose gaps in plans and communication, and improve coordination without the risk of impacting real systems.

CSOC Practice Test

CSOC Practice Test

CSOC Security Operations Procedures 2