Back to Subject

Unit 1: SOC Fundamentals and Incident Response - Practice Quiz

INT244 — Securing Computing Systems 60 Questions
0 Correct 0 Wrong 60 Left
0/60

1 What is the primary purpose of a Security Operations Center (SOC)?

Introduction to SOC: overview of SOC Easy
A. To monitor and protect an organization's systems
B. To manage employee salaries
C. To repair office equipment
D. To design company websites

2 Why is a SOC important to an organization?

Introduction to SOC: importance of SOC Easy
A. It reduces the need for computer networks
B. It replaces all software developers
C. It helps detect and respond to security threats
D. It prevents employees from using email

3 Which is a common challenge faced by a SOC?

Introduction to SOC: challenges in SOC Easy
A. Too many printed documents
B. Too few office chairs
C. Too many security alerts
D. Too much computer storage

4 What is a typical responsibility of a SOC analyst?

Introduction to SOC: roles and responsibilities Easy
A. Managing building access cards
B. Reviewing security alerts
C. Creating advertising campaigns
D. Preparing employee meals

5 Which SOC model is operated by an organization's own security team?

Introduction to SOC: models Easy
A. Public SOC
B. Temporary SOC
C. Internal SOC
D. Personal SOC

6 What do SOC pillars generally represent?

SOC Pillars: introduction Easy
A. Methods of network cabling
B. Core areas of SOC operations
C. Categories of programming languages
D. Types of office furniture

7 Which activity belongs to the detection pillar of a SOC?

SOC Pillars: definition of SOC pillars Easy
A. Ordering computer equipment
B. Designing company logos
C. Identifying suspicious activity
D. Writing employee contracts

8 Why are SOC pillars important?

SOC Pillars: importance of SOC pillars Easy
A. They organize security activities
B. They remove the need for monitoring
C. They replace security policies
D. They eliminate all security risks

9 Which SOC analyst level usually handles basic alert monitoring and triage?

SOC Pillars: levels of SOC analysis Easy
A. Level 3 analyst
B. Level 4 analyst
C. Level 1 analyst
D. Level 2 analyst

10 What should a SOC team consider when prioritizing security alerts?

SOC Pillars: prioritization and analysis Easy
A. The analyst's favorite tool
B. The alert's font color
C. The number of office computers
D. Potential impact and severity

11 What is the goal of remediation after a security incident?

SOC Pillars: remediation and recovery Easy
A. Remove the threat and fix affected systems
B. Delete all security logs
C. Disable every user account
D. Ignore the affected systems

12 What is the purpose of a security assessment or audit?

SOC Pillars: assessment and audit Easy
A. To increase internet speed
B. To evaluate security controls
C. To create social media content
D. To replace operating systems monthly

13 What does threat intelligence provide to a SOC?

SOC Pillars: threat intelligence Easy
A. Computer hardware discounts
B. Instructions for office cleaning
C. A list of employee holidays
D. Information about current threats

14 Which phase of the incident response lifecycle involves identifying a possible incident?

Security Incident Response: incident response lifecycle Easy
A. Detection
B. Recovery
C. Preparation
D. Lessons learned

15 What is the main purpose of the preparation phase in incident response?

Security Incident Response: incident response lifecycle Easy
A. Plan and prepare response capabilities
B. Replace all network devices
C. Publish the incident publicly
D. Delete evidence from systems

16 Why should investigators preserve security logs during an incident?

Security Incident Response: handling and investigation technique Easy
A. They increase network bandwidth
B. They remove malware immediately
C. They automatically stop the attack
D. They may provide useful evidence

17 What is a key purpose of post-incident analysis?

Security Incident Response: post-incident analysis Easy
A. Hide the incident from all staff
B. Remove all response procedures
C. Stop collecting security data
D. Identify improvements for future incidents

18 What is an important rule when sharing incident information?

Security Incident Response: information sharing in incident response Easy
A. Share it with authorized parties
B. Send it to unknown recipients
C. Remove all identifying information automatically
D. Post all details on public websites

19 Which communication practice is best during a security incident?

Security Incident Response: communication strategies Easy
A. Send unrelated information
B. Use confusing technical language
C. Provide clear and timely updates
D. Delay every important message

20 What should an organization do first when a confirmed incident affects an important server?

Security Incident Response: incident response in IT environment Easy
A. Erase the server's logs
B. Ignore the incident temporarily
C. Follow the incident response plan
D. Turn off every device immediately

21 A company notices that security alerts are being handled inconsistently by different IT teams. Which SOC capability would most directly address this problem?

Introduction to SOC: overview of SOC Medium
A. Migration of every application to cloud hosting
B. Removal of all remote-access services
C. Centralized monitoring and coordinated response
D. Annual replacement of network hardware

22 Why does continuous SOC monitoring generally reduce the impact of security incidents?

Introduction to SOC: importance of SOC Medium
A. It eliminates the need for user security training
B. It identifies suspicious activity before damage expands
C. It prevents every vulnerability from being created
D. It guarantees that attackers cannot access systems

23 A SOC receives thousands of alerts daily, but only a small number represent real attacks. Which challenge is illustrated?

Introduction to SOC: challenges in SOC Medium
A. Excessive segmentation of internal networks
B. Lack of encryption in archived documents
C. Alert fatigue caused by excessive false positives
D. Insufficient physical security at the office

24 During an active ransomware incident, which responsibility best fits a SOC analyst?

Introduction to SOC: roles and responsibilities Medium
A. Approve the organization's annual budget
B. Rewrite all employee employment contracts
C. Design the company's public advertising campaign
D. Review alerts and validate suspicious activity

25 An organization operates its own monitoring team, infrastructure, and incident response process. Which SOC model is being used?

Introduction to SOC: models Medium
A. A temporary incident-only SOC
B. An internally managed SOC
C. A fully outsourced SOC
D. A vendor-neutral audit SOC

26 A SOC improves detection but repeatedly fails to contain incidents and restore services. Which conclusion is most appropriate?

SOC Pillars: introduction Medium
A. Detection alone is sufficient for complete protection
B. The organization should disable all automated alerts
C. Its security functions are not balanced across the SOC pillars
D. Incident response is unrelated to SOC effectiveness

27 Which statement best describes SOC pillars?

SOC Pillars: definition of SOC pillars Medium
A. They are separate passwords used by SOC analysts
B. They are related capability areas supporting security operations
C. They are legal penalties assigned after every breach
D. They are physical zones inside a security operations center

28 Why are SOC pillars useful when an organization evaluates its security operations?

SOC Pillars: importance of SOC pillars Medium
A. They reveal capability gaps across the security process
B. They restrict analysts to reviewing only network traffic
C. They ensure all security incidents have identical causes
D. They replace the need to define security objectives

29 An analyst correlates firewall, endpoint, and identity logs to determine whether several alerts are part of one attack. Which analysis level is most clearly involved?

SOC Pillars: levels of SOC analysis Medium
A. Advanced correlation and incident analysis
B. Physical access badge administration
C. Basic device inventory collection
D. Routine password expiration management

30 Which alert should a SOC prioritize first?

SOC Pillars: prioritization and analysis Medium
A. A user entering an incorrect password once
B. A routine antivirus update on a workstation
C. A confirmed compromise of a critical database server
D. A blocked scan from an unknown external address

31 After confirming that an endpoint is infected, which action best supports remediation and recovery?

SOC Pillars: remediation and recovery Medium
A. Delete all logs before rebuilding the endpoint
B. Reconnect the endpoint immediately to test the network
C. Ignore the infection after changing the user's password
D. Isolate the endpoint, remove the malware, and restore safely

32 An audit finds that analysts do not consistently document containment decisions. What is the main value of this finding?

SOC Pillars: assessment and audit Medium
A. It confirms that technical controls are unnecessary
B. It proves that no security incident has occurred
C. It shows that all analysts should use identical passwords
D. It identifies a process weakness requiring corrective action

33 A threat intelligence report identifies the command-and-control domain used by a known attacker group. How should the SOC use this information?

SOC Pillars: threat intelligence Medium
A. Create detections and search historical activity for the domain
B. Remove all domain name resolution from the organization
C. Assume every connection to the internet is malicious
D. Publish the domain publicly before validating the report

34 Which sequence best represents a typical incident response lifecycle?

Security Incident Response: incident response lifecycle Medium
A. Recovery, preparation, eradication, detection, containment, audit
B. Containment, publicity, detection, recovery, preparation, deletion
C. Detection, recovery, preparation, containment, publicity, eradication
D. Preparation, detection, containment, eradication, recovery, lessons learned

35 An analyst suspects that a workstation is communicating with an attacker. Which investigation step is most appropriate initially?

Security Incident Response: handling and investigation technique Medium
A. Announce the suspected attacker identity to all employees
B. Reformat the workstation before collecting any evidence
C. Preserve relevant evidence and examine network connections
D. Disconnect every system in the organization immediately

36 A post-incident review shows that an alert was generated but remained unassigned for six hours. What improvement is most relevant?

Security Incident Response: post-incident analysis Medium
A. Define alert ownership and escalation time targets
B. Require users to investigate alerts without SOC support
C. Remove the alert rule to reduce analyst workload
D. Stop recording timestamps during future incidents

37 Why should incident responders share validated indicators with relevant internal teams?

Security Incident Response: information sharing in incident response Medium
A. Sharing indicators guarantees that the incident is fully resolved
B. Other teams can search for related activity and strengthen defenses
C. Indicators eliminate the need to preserve incident evidence
D. Internal teams can replace all forensic analysis with the indicators

38 During a major incident, which communication practice is most effective?

Security Incident Response: communication strategies Medium
A. Provide approved, timely updates tailored to each audience
B. Share every preliminary suspicion with the public
C. Use technical logs as the only update for executives
D. Delay all communication until the incident is completely understood

39 A compromised virtual server hosts a business-critical application. Which response action best balances containment and availability?

Security Incident Response: incident response in IT environment Medium
A. Leave the server online until the business day ends
B. Isolate the affected instance and fail over to a verified clean system
C. Delete the virtual server immediately without preserving evidence
D. Shut down every production server without checking dependencies

40 A SOC manager is deciding how to improve coverage outside normal business hours. Which responsibility is most relevant to this decision?

Introduction to SOC: roles and responsibilities Medium
A. Designing staffing, escalation, and operational coverage
B. Replacing all incident tickets with informal conversations
C. Selecting colors for the organization's security dashboard
D. Approving individual employee vacation destinations

41 A SOC receives an alert that an administrator account authenticated from an unusual country. Which action best reflects the SOC's core function?

Introduction to SOC: overview of SOC Hard
A. Correlate identity, endpoint, network, and behavioral evidence
B. Block every connection from that country
C. Reset all administrator passwords immediately
D. Close the alert because geolocation is unreliable

42 An organization has deployed strong preventive controls but still experiences occasional credential compromise. Which SOC capability most directly reduces the resulting business impact?

Introduction to SOC: importance of SOC Hard
A. Mandatory encryption of every internal message
B. Removal of all externally accessible services
C. Annual replacement of perimeter firewalls
D. Continuous detection and coordinated containment

43 A SOC has a high alert volume, but analysts spend most of their time investigating benign events and miss a real ransomware intrusion. Which underlying challenge is most evident?

Introduction to SOC: challenges in SOC Hard
A. Insufficient cryptographic key rotation
B. Overreliance on physical access controls
C. Excessive false positives and alert fatigue
D. Inadequate software licensing records

44 During an active breach, which division of responsibility is most appropriate?

Introduction to SOC: roles and responsibilities Hard
A. The analyst approves legal notifications and public statements
B. The threat hunter restores systems without change approval
C. The SOC manager performs every forensic acquisition
D. The incident commander coordinates actions and decision authority

45 An organization operates a small internal monitoring team but contracts a provider for overnight monitoring and specialized investigations. Which SOC model best describes this arrangement?

Introduction to SOC: models Hard
A. Fully outsourced SOC
B. Hybrid SOC
C. Distributed SOC without external support
D. Fully internal SOC

46 A SOC redesign groups its program into people, process, technology, intelligence, and measurement. What is the principal benefit of this pillar-based view?

SOC Pillars: introduction Hard
A. It guarantees that incidents will be prevented
B. It exposes capability gaps across interdependent functions
C. It limits security operations to technical controls
D. It replaces the need for incident-specific judgment

47 Which statement best defines SOC pillars in an operational context?

SOC Pillars: definition of SOC pillars Hard
A. A hierarchy of incident severity classifications
B. A checklist used only during compliance examinations
C. Foundational capability areas supporting detection and response
D. Independent products purchased from security vendors

48 A SOC owns an advanced SIEM but has inconsistent escalation procedures and no validated contact roster. Which conclusion follows from the pillar model?

SOC Pillars: importance of SOC pillars Hard
A. Technology eliminates the process deficiency
B. The contact roster is unrelated to SOC maturity
C. The SIEM should be replaced before processes are reviewed
D. The SOC has a capability imbalance despite strong tooling

49 An alert has been correlated with a known malicious domain, but the analyst must determine whether the activity represents a coordinated intrusion. Which analysis level is most appropriate next?

SOC Pillars: levels of SOC analysis Hard
A. Incident-level scope and campaign analysis
B. Triage-level alert acknowledgment
C. Asset-level inventory reconciliation
D. Event-level log formatting

50 Two alerts have equal confidence. Alert A affects a public web server with limited privileges; Alert B affects a domain administrator workstation showing lateral movement. Which should receive higher priority?

SOC Pillars: prioritization and analysis Hard
A. Alert A because public systems are always urgent
B. Alert A because web traffic is easier to investigate
C. Alert B because privilege and propagation risk are greater
D. Both alerts because confidence determines priority alone

51 After containing malware on several endpoints, which recovery decision is most defensible before returning systems to production?

SOC Pillars: remediation and recovery Hard
A. Delete the detection rule after the malware is removed
B. Rebuild or restore from trusted sources and verify controls
C. Reconnect isolated hosts to test whether symptoms recur
D. Restore from the newest backup without validation

52 An audit finds that incident tickets are consistently closed within the target time, but no evidence shows whether containment was effective. What weakness does this reveal?

SOC Pillars: assessment and audit Hard
A. The SOC has no need for measurable response objectives
B. Containment effectiveness cannot be assessed operationally
C. The SOC measures speed without validating outcome quality
D. The audit should examine only ticket closure timestamps

53 A threat feed reports an IP address associated with a botnet, but the address is also used by a cloud hosting provider. What should the SOC do before blocking it globally?

SOC Pillars: threat intelligence Hard
A. Replace the feed with a list of internal IP addresses
B. Block it immediately because every feed indicator is definitive
C. Validate context, scope, recency, and observed malicious behavior
D. Ignore it because infrastructure indicators are never useful

54 Which sequence most accurately represents a conventional incident response lifecycle?

Security Incident Response: incident response lifecycle Hard
A. Recovery, preparation, containment, lessons learned
B. Containment, preparation, recovery, detection, audit
C. Preparation, detection and analysis, containment, eradication and recovery, lessons learned
D. Detection, public disclosure, eradication, preparation, recovery

55 An endpoint suspected of compromise is still powered on and may contain volatile evidence. Which action best balances investigation and containment?

Security Incident Response: handling and investigation technique Hard
A. Immediately power it off and discard volatile evidence
B. Reboot it repeatedly to test whether the alert persists
C. Allow unrestricted network access until imaging is complete
D. Capture relevant volatile data, then isolate the endpoint

56 A post-incident review determines that a compromised account had excessive privileges, but the report blames only the analyst who missed the alert. What is the main deficiency?

Security Incident Response: post-incident analysis Hard
A. The analyst should be assigned all remediation tasks
B. The report should contain only technical indicators
C. The review should exclude identity-control weaknesses
D. The review focuses on individual blame instead of systemic causes

57 Before sharing an incident indicator with an industry information-sharing group, which consideration is most important?

Security Incident Response: information sharing in incident response Hard
A. Whether sharing removes the need to preserve evidence
B. Whether the indicator has a visually distinctive format
C. Whether the indicator can be shared with context and authorization
D. Whether every internal log can be included without filtering

58 During a major outage caused by a suspected cyberattack, which communication practice is most appropriate?

Security Incident Response: communication strategies Hard
A. Delay all communication until the investigation is complete
B. Release unverified attribution to demonstrate transparency
C. Provide regular factual updates with owners and next actions
D. Allow every technical team to issue independent statements

59 A response team isolates a production database server without consulting application owners, causing a critical service outage. Which improvement best addresses the failure?

Security Incident Response: incident response in IT environment Hard
A. Permit analysts to make all service-impacting decisions
B. Wait for executive approval before every containment action
C. Use risk-based playbooks with business-owner escalation paths
D. Prohibit containment of production systems

60 Investigators find that a malicious PowerShell process spawned from a document viewer, accessed a token, and then initiated remote service execution. Which technique best supports scoping the intrusion?

Security Incident Response: handling and investigation technique Hard
A. Construct a process, identity, and lateral-movement timeline
B. Review only the originating document's filename
C. Search only for the original malware hash
D. Delete all PowerShell logs to prevent duplication
Next MCQ
Unit 2