CSX Security Operations Center (SOC) Operations 3

Question 1

What is the first phase of the incident response lifecycle according to NIST SP 800-61?

Accepted Answer

Preparation

Answer

Containment

Answer

Eradication

Answer

Recovery

Question 2

In incident response, what does 'containment' refer to?

Accepted Answer

Limiting the spread and impact of an active security incident to prevent further damage

Answer

Permanently removing malware and attacker tools from all affected systems

Answer

Documenting lessons learned and publishing the post-incident report

Answer

Restoring all systems and services to normal business operations

Question 3

Which document provides step-by-step procedural guidance for SOC analysts responding to a specific incident type?

Accepted Answer

Runbook or playbook

Answer

Network topology diagram

Answer

Business continuity plan

Answer

Service level agreement (SLA)

Question 4

What is the primary goal of a post-incident review (PIR) or lessons-learned session?

Accepted Answer

To identify what worked, what failed, and how to improve future incident response capabilities

Answer

To assign individual blame and document personnel disciplinary actions

Answer

To calculate the full financial impact of the incident for insurance purposes

Answer

To notify affected customers about upcoming pricing changes

Question 5

What is 'threat hunting' in SOC operations?

Accepted Answer

Proactively searching networks and endpoints for threats that have evaded automated detection

Answer

Automatically blocking all unrecognized IP addresses in the firewall

Answer

Hiring experienced security analysts away from competitor organizations

Answer

Updating antivirus and endpoint protection signatures on a daily schedule

Question 6

Which principle describes deploying multiple overlapping security controls across different layers of the environment?

Accepted Answer

Defense in depth

Answer

Least privilege access control

Answer

Zero trust architecture

Answer

Security through obscurity

Question 7

What is the key responsibility of a SOC manager in a mature security operations program?

Accepted Answer

Overseeing SOC operations, managing analyst teams, and ensuring incident response processes meet organizational objectives

Answer

Writing custom exploit code for offensive security engagements

Answer

Performing hands-on malware reverse engineering and binary analysis

Answer

Conducting physical security assessments of office facilities and data centers