CSX Security Operations Center (SOC) Operations

Question 1

What is the primary function of a Security Operations Center (SOC)?

Accepted Answer

Continuously monitoring and analyzing an organization's security posture

Answer

A SOC's primary function is to continuously monitor, detect, analyze, and respond to cybersecurity threats and incidents around the clock.

Question 2

Which tier in a typical three-tier SOC structure is responsible for initial alert triage?

Accepted Answer

Tier 1 (alert analysts)

Answer

Tier 1 analysts handle the first line of monitoring and triage incoming alerts to determine severity before escalating to higher tiers.

Question 3

What is a 'false positive' in the context of SOC alert management?

Accepted Answer

An alert triggered by legitimate activity that is mistakenly identified as malicious

Answer

A false positive occurs when a security tool flags benign or legitimate activity as a threat, requiring analyst time to investigate and dismiss.

Question 4

Which metrics are most commonly used to measure SOC effectiveness in detecting and resolving incidents?

Accepted Answer

Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)

Answer

MTTD and MTTR are key performance indicators measuring how quickly threats are identified and how rapidly they are contained or resolved.

Question 5

What is the purpose of a threat intelligence feed in SOC operations?

Accepted Answer

To provide current information about known threats, IoCs, and attacker TTPs

Answer

Threat intelligence feeds supply analysts with up-to-date indicators of compromise and adversary tactics to improve proactive detection capabilities.

(CSX) Cybersecurity Nexus Certification Practice Test