CSX Security Operations Center (SOC) Operations

Question 1

What is the primary function of a Security Operations Center (SOC)?

Accepted Answer

Continuously monitoring and analyzing an organization's security posture

Answer

Developing new software applications

Answer

Managing human resources and employee onboarding

Answer

Performing financial audits and compliance reviews

Question 2

Which tier in a typical three-tier SOC structure is responsible for initial alert triage?

Accepted Answer

Tier 1 (alert analysts)

Answer

Tier 3 (advanced threat hunters)

Answer

Tier 2 (incident responders)

Answer

Tier 0 (automation layer)

Question 3

What is a 'false positive' in the context of SOC alert management?

Accepted Answer

An alert triggered by legitimate activity that is mistakenly identified as malicious

Answer

A confirmed security incident that was successfully remediated

Answer

A critical vulnerability that has not yet been patched

Answer

A successful red team penetration test finding

Question 4

Which metrics are most commonly used to measure SOC effectiveness in detecting and resolving incidents?

Accepted Answer

Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)

Answer

Number of tools deployed and total log volume ingested

Answer

Total number of employees in the SOC and annual training hours

Answer

Cost per security tool license and vendor renewal dates

Question 5

What is the purpose of a threat intelligence feed in SOC operations?

Accepted Answer

To provide current information about known threats, IoCs, and attacker TTPs

Answer

To track employee productivity and workstation activity

Answer

To generate financial reports on security spending and ROI

Answer

To manage software license renewals and vendor contracts

Question 6

What is 'alert fatigue' in a SOC environment?

Accepted Answer

When analysts become desensitized to alerts due to excessive volume, increasing the risk of missing real threats

Answer

When security monitoring tools stop generating alerts due to configuration errors

Answer

When network bandwidth is overwhelmed by traffic from monitoring agents

Answer

When a SIEM license expires and alerting functionality is disabled

Question 7

Which SOC staffing model involves outsourcing security monitoring to a third-party provider?

Accepted Answer

Managed Security Service Provider (MSSP)

Answer

Dedicated internal SOC

Answer

Virtual SOC with part-time staff

Answer

Co-managed hybrid SOC