Security Operations and Defense Analyst

Which metric could help identify the following issue: A new data source was improperly configured and is generating a high volume of alerts

• Total event volume

• Events by Source type

• Quality of Escalations

• Index forwarding

Which metric could help identify the following issue? An existing connection was lost and we are no longer receiving messages from a source

• Index forwarding

• Quality of Escalations

• Events by Source type

• Total event volume

Which metric could help identify the following issue? Analysts are overwhelmed and are not able to fully investigate all incidents thoroughly

• Quality of escalations

• Events by Source type

• Total event volume

• Index forwarding

What SOC metric measures, How long it took to detect a threat in the environment?

• Dwell-time

• MTTA

• MTTR

• MTTD

What are other non-primary but important tasks that Cybersecurity Defense Analysts can perform to help improve Security Operations? (Select 3)

• Get data, assets and identities into Splunk

• Provide detailed documentation in their reports and notes for other teams and analysts

• Request improvements and the development of dashboards, searches and tooling

• Select protection tools that will be used in the organization

• Share suggestions for automation and improved remediation steps

According to the Blue Team Academy definitions, which of these activities are performed more often by the Cybersecurity Defense Analyst in a SOC? (Select 2)

• Creating new detection rules

• Threat Hunting

• Alert triage

• Ensuring data is brought to the corresponding SIEM

An Analyst is triaging a new event with the following alert message: "Authentication errors exceeded for user ST002".

During investigation, the Analyst finds evidence of attempts to use a dictionary attack to gain access to this account.

With the provided context, what disposition would you assign to this event?

• True Positive

• False Positive

The Security Posture of an organization represents how well an organization can predict, prevent and (a)   to ever-changing cyber threats.

Which stages of the Continuous Monitoring cycle is the Cybersecurity Defense Analyst primarily associated with?

• Implement and collect

• Respond and review

• Define and predict

• Analyze and report

• Establish and architect

What is one reason why it is important to have good metrics in a SOC? 

• increasing the number of alerts handled per day will show the team is being effective

• they can distract from the goal of preventing threats from causing harm to the organization

• they can help you advocate for yourself and for better tools and processes