Unit 4: Response Automation and SOC Metrics - Practice Quiz

1 What is the main purpose of incident response automation?

2 Which result commonly shows that automation has improved a SOC?

3 What is the role of a playbook in incident response?

4 What is a threat-specific playbook designed to address?

5 In automated incident response, what does gathering usually involve?

6 Why should a SOC collect information from diverse sources?

7 Which measure is commonly used to assess response efficiency?

8 How can automation improve SOC performance?

9 How can SOC metrics support cyber resilience?

10 What does performance measurement help a SOC understand?

11 What is the purpose of anomaly detection in a SOC?

12 Which metric measures the average time between detecting and resolving an incident?

13 What does a skills investment gap assessment identify?

14 Which financial metric can help evaluate the cost of SOC operations?

15 How can AI and machine learning assist SOC operations?

16 Which is a likely future trend in SOC metrics?

17 Which is a core area commonly measured in a SOC?

18 What is one possible risk of poorly designed automation?

19 What is a generic playbook intended to provide?

20 Which metric can help measure the quality of alert handling?

21 A SOC wants to reduce repetitive manual actions during incident handling. Which capability best represents incident response automation and orchestration?

22 After automating phishing triage, which result provides the strongest evidence that the automation improved SOC performance?

23 What is the primary purpose of a playbook in an automated incident response process?

24 A SOC is responding to ransomware incidents that require file-hash checks, endpoint isolation, and recovery coordination. Why would a threat-specific playbook be preferable to a generic one?

25 During an investigation, an orchestration platform gathers threat intelligence about a suspicious domain and automatically enriches the related alert. What is the main benefit?

26 Why should an automated response workflow collect data from endpoints, identity systems, firewalls, and threat intelligence feeds?

27 Which combination best measures both the efficiency and effectiveness of an automated response workflow?

28 A playbook frequently isolates legitimate business systems because its trigger conditions are too broad. What is the most appropriate improvement?

29 How can SOC metrics contribute to cyber resilience rather than merely report historical activity?

30 A SOC reports that it closed 95% of tickets within its target time, but major incidents continued to cause long outages. What does this suggest about the measurement approach?

31 A baseline shows that a user normally accesses systems during business hours from one country. An automated metric flags repeated nighttime access from several countries. What is the metric primarily detecting?

32 Which metric most directly measures the time between an incident being detected and the beginning of containment?

33 A skills assessment shows that analysts are strong in alert triage but weak in cloud forensics. Which action best addresses the identified investment gap?

34 Which financial measure is most useful for comparing the value of a response automation project with its cost?

35 An AI model reduces alert volume by grouping similar events, but analysts discover that some real attacks are being grouped incorrectly. Which metric should be reviewed most urgently?

36 Which future trend would make SOC metrics more useful for business decision-making?

37 Which set includes core areas commonly used to evaluate SOC performance?

38 A SOC automates low-risk account lockouts but requires analyst approval before disabling privileged accounts. What principle does this design demonstrate?

39 An incident response team detects threats quickly, but containment is delayed because incidents are repeatedly reassigned between teams. Which metric would best expose this weakness?

40 An automated playbook receives timestamps from systems configured in different time zones. What should the SOC do before correlating events?

41 A SOC wants to automate containment of endpoint alerts. Which design principle most directly reduces the risk that automation amplifies a false positive into a business outage?

42 After automation is introduced, mean time to respond decreases by 40%, but the rate of reopened incidents doubles. Which conclusion is most defensible?

43 A playbook contains conditional branches, approval gates, evidence requirements, and rollback actions. What is its primary operational value?

44 When is a threat-specific playbook preferable to a generic malware-response playbook?

45 A playbook automatically gathers identity, endpoint, DNS, and cloud evidence before recommending containment. Which capability is being demonstrated?

46 A correlation workflow joins logs from an identity provider, EDR, firewall, and SaaS platform. Which issue is most likely to produce a misleading incident timeline?

47 Which measurement set best distinguishes faster processing from genuinely better incident outcomes?

48 A SOC automates enrichment but leaves analysts responsible for manually copying results between tools. Which improvement is most likely to produce the greatest performance gain?

49 A quarterly report shows fewer incidents, but critical business services experience longer outages during the incidents that remain. Which metric interpretation is most appropriate?

50 A team compares analyst MTTR across two quarters, but the second quarter contains many more complex cloud incidents. What is the strongest measurement correction?

51 A metric normally varies seasonally, but a detection system flags every predictable end-of-quarter increase as anomalous. What change would most improve its validity?

52 Which metric most directly tests whether containment actions prevent an attacker from regaining access?

53 A SOC has strong endpoint expertise but repeatedly delays incidents involving identity federation and cloud control planes. Which assessment provides the most actionable investment decision?

54 Which financial measure best evaluates whether an automation project creates value when it reduces analyst effort but requires substantial licensing costs?

55 An ML model improves alert prioritization overall but performs poorly on rare incidents affecting critical systems. Which evaluation approach is most appropriate?

56 Which future-oriented metric would best reflect the effectiveness of a SOC operating in a highly automated environment?

57 Which combination covers the core dimensions needed to evaluate a SOC comprehensively?

58 Automation closes low-confidence alerts after checking only one data source. Which governance control most directly addresses the resulting risk?

59 A generic credential-compromise playbook disables an account immediately, but a threat-specific playbook first checks whether the account is used by a production service. Why is the latter safer?

60 A sudden drop in detected incidents occurs after a log collector silently loses 30% of endpoint telemetry. Which metric design would help reveal the problem earliest?