cyberops

Which personnel in a SOC is assigned the task of verifying whether an alert triggered by monitoring software represents a true security incident?

• Tier 1 Personnel

• Tier 2 Personnel

• Tier 3 Personnel

• SOC Manager

After a security incident is verified in a SOC, an incident responder reviews the incident but cannot identify the source of the incident and form an effective mitigation procedure. To whom should the incident ticket be escalated?

• the SOC manager to ask other personnel to be assigned

• an alert analyst for further analysis

• a cyberoperations analyst for help

• a SME for further investigation

Which two services are provided by security operations centers? (Choose two.)

• responding to data center physical break-ins

• monitoring network security threats

• managing comprehensive threat solutions

• ensuring secure routing packet exchanges

• providing secure internet connections

Which organization is an international nonprofit organization that offers the CISSP certification?

• CompTIA

• (ISC)²

• IEEE

• GIAC

Answer explanation

(ISC)² is an international nonprofit organization that offers the CISSP certification.

What is a benefit to an organization of using SOAR as part of the SIEM system?

• SOAR was designed to address critical security events and high-end investigation.

• SOAR would benefit smaller organizations because it requires no cybersecurity analyst involvement once installed.

• SOAR automates incident investigation and responds to workflows based on playbooks

• SOAR automation guarantees an uptime factor of “5 nines”.

Answer explanation

Explanation: SIEM systems are used for collecting and filtering data, detecting and classifying threats, and analyzing and investigating threats. SOAR technology does the same as SIEMs but it also includes automation. SOAR integrates threat intelligence and automates incident investigation. SOAR also responds to events using response workflows based on previously developed playbooks.

Which personnel in a SOC are assigned the task of hunting for potential threats and implementing threat detection tools?

• Tier 3 SME

• Tier 2 Incident Reporter

• Tier 1 Analyst

• SOC Manager

Answer explanation

In a SOC, Tier 3 SMEs have expert-level skills in network, endpoint, threat intelligence, and malware reverse engineering (RE). They are deeply involved in hunting for potential security threats and implementing threat detection tools.

An SOC is searching for a professional to fill a job opening. The employee must have expert-level skills in networking, endpoint, threat intelligence, and malware reverse engineering in order to search for cyber threats hidden within the network. Which job within an SOC requires a professional with those skills?

• Incident Responder

• Alert Analyst

• SOC Manager

• Threat Hunter

Answer explanation

Tier 3 professionals called Threat Hunters must have expert-level skills in networking, endpoint, threat intelligence, and malware reverse engineering. They are experts at tracing the processes of malware to determine the impact of the malware and how it can be removed.

Which three are major categories of elements in a security operations center? (Choose three.)

• technologies

• people

• processes

• data center

• database engine

Which KPI metric does SOAR use to measure the time required to stop the spread of malware in the network?

• MITR

  Time to Control

• Time to Control

• MITC

• MTTD

Answer explanation

The common key performance indicator (KPI) metrics compiled by SOC managers are as follows:• Dwell Time: the length of time that threat actors have access to a network before they are detected and the access of the threat actors stopped