Security Operations Center (SOC) Operations Flashcards

What is the first phase of the incident response lifecycle according to NIST SP 800-61?

Answer: Preparation

NIST SP 800-61 defines Preparation as the first phase, focusing on building incident response capabilities before any incident occurs.

In incident response, what does 'containment' refer to?

Answer: Limiting the spread and impact of an active security incident to prevent further damage

Containment focuses on isolating affected systems or blocking attacker activity to stop the incident from spreading before full remediation begins.

Which document provides step-by-step procedural guidance for SOC analysts responding to a specific incident type?

Answer: Runbook or playbook

Runbooks and playbooks are pre-written procedural guides that walk analysts through the exact steps to take when responding to specific incident scenarios.

What is the primary goal of a post-incident review (PIR) or lessons-learned session?

Answer: To identify what worked, what failed, and how to improve future incident response capabilities

A PIR analyzes the incident response process to surface improvements that strengthen detection, response, and prevention for future events.

What is 'threat hunting' in SOC operations?

Answer: Proactively searching networks and endpoints for threats that have evaded automated detection

Threat hunting is a proactive, human-driven activity where analysts manually investigate systems to uncover stealthy threats that bypassed automated tools.

Which principle describes deploying multiple overlapping security controls across different layers of the environment?

Answer: Defense in depth

Defense in depth applies multiple security controls across network, endpoint, application, and data layers so that the failure of one control does not result in a full compromise.

What is the key responsibility of a SOC manager in a mature security operations program?

Answer: Overseeing SOC operations, managing analyst teams, and ensuring incident response processes meet organizational objectives

The SOC manager oversees the team, ensures processes are effective, monitors performance metrics, and aligns SOC operations with the organization's security strategy.