Security Operations Procedures Flashcards
6 cards from real CSOC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Security Operations Procedures flashcards as text
What is 'Security Orchestration, Automation, and Response' (SOAR) in CSOC operations?
Answer: Technology that automates repetitive security tasks, integrates different security tools, and orchestrates incident response workflows to improve speed and efficiency
SOAR platforms automate routine, repetitive tasks such as alert enrichment, notification, and simple response actions, freeing analysts to focus on higher-value investigation and decision-making. They also integrate disparate security tools into unified workflows.
What is the 'kill chain' framework in cybersecurity operations?
Answer: A model describing the stages of a cyber attack from reconnaissance through to data exfiltration, used to understand and disrupt attacks at each stage
The cyber kill chain describes the sequential stages of a cyber attack: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Understanding the kill chain helps defenders identify opportunities to detect and disrupt attacks at each stage.
Under Singapore's regulatory framework, which CSOC-related obligation do operators of Critical Information Infrastructure (CII) have under the Cybersecurity Act?
Answer: CII owners must comply with mandatory cybersecurity standards and audits, and are required to report prescribed cybersecurity incidents to CSA
Under the Cybersecurity Act, CII owners face enhanced obligations including mandatory compliance with codes of practice, regular cybersecurity audits, incident reporting requirements, and participation in cybersecurity exercises as directed by CSA.
What is 'threat modelling' and how is it used in security operations planning?
Answer: A structured process for identifying potential threats, attack vectors, and adversaries relevant to a specific system or organisation to inform defensive priorities
Threat modelling systematically identifies who might attack a system, what they want to achieve, how they might do it, and what the impact would be. This informs the prioritisation of security controls and monitoring activities to address the most relevant threats.
What is the purpose of tabletop exercises in a CSOC environment?
Answer: To simulate cybersecurity incidents in a discussion-based format, testing and improving the team's response plans, decisions, and coordination without impacting real systems
Tabletop exercises are scenario-based discussions where participants walk through their response to a simulated incident. They test decision-making, expose gaps in plans and communication, and improve coordination without the risk of impacting real systems.
What is 'defence in depth' in cybersecurity operations?
Answer: A security strategy that uses multiple, layered security controls so that if one fails, others remain to protect the system
Defence in depth applies multiple security controls at different layers — network, host, application, and data — so that an attacker who bypasses one control still faces additional barriers. It eliminates single points of failure in a security architecture.