Security Operations Procedures Flashcards
6 cards from real CSOC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Security Operations Procedures flashcards as text
What is the primary function of a Cybersecurity Operations Centre (CSOC)?
Answer: To continuously monitor an organisation's IT environment for threats, detect security incidents, and coordinate response activities
A CSOC is dedicated to 24/7 monitoring of an organisation's security environment, detecting and analysing threats, and coordinating incident response. It serves as the central hub for operational cybersecurity activities.
What does 'triage' mean in CSOC operations?
Answer: The process of evaluating and prioritising security alerts and incidents based on their severity, potential impact, and urgency
Triage in a CSOC involves assessing incoming alerts to determine their validity, severity, and required response priority. Given the volume of alerts, effective triage is essential to ensure that the most serious threats receive immediate attention.
What is an escalation matrix in CSOC operations?
Answer: A defined structure that specifies who should be notified and when, based on the severity of a security incident
An escalation matrix defines the chain of notification for security incidents, specifying which individuals or teams must be notified at different severity levels and within what timeframes. It ensures the right people are informed at the right time.
What is the significance of maintaining accurate and detailed incident tickets in CSOC operations?
Answer: Incident tickets provide a traceable record of all actions taken, support analysis and reporting, and ensure continuity when different analysts handle the same incident
Incident tickets document every step of the detection, analysis, and response process. They enable handover between analysts across shifts, support post-incident reviews, provide evidence for reporting and compliance, and create an audit trail.
What is 'shift handover' in a 24/7 CSOC and what information should it include?
Answer: The structured transfer of situational awareness between outgoing and incoming shift teams, covering active incidents, monitoring status, and any pending actions
Shift handover ensures continuity in a 24/7 CSOC. The outgoing team briefs the incoming team on active incidents, ongoing investigations, any changes to the environment, and pending tasks, so there is no gap in situational awareness.
Why is documentation of Standard Operating Procedures (SOPs) important in a CSOC?
Answer: SOPs ensure consistent and repeatable responses to common scenarios, reduce reliance on individual knowledge, and support training of new staff
SOPs standardise how the CSOC handles common situations, ensuring consistency and quality regardless of which analyst is on duty. They are also vital for training new staff and for review and improvement through post-incident analysis.