Monitoring in SOC

1. What is monitoring in a Security Operations Center (SOC)?

A. Continuous observation of systems, networks, and logs to detect threats

B. Installing software updates on systems

C. Designing websites for security teams

D. Managing employee attendance records

2. What are the main data sources used for monitoring in a SOC?

A. Social media posts and emails only

B. System logs, network traffic, firewall logs, and endpoint data

C. Payroll databases

D. Printer configuration files

3. Scenario: A monitoring tool detects a sudden increase in outbound network traffic. What could this indicate?

A. Normal software update

B. Printer synchronization

C. System reboot process

D. Data exfiltration or malware communication

4. What is the role of SIEM in SOC monitoring?

A. To block all network traffic

B. To store employee records

C. To collect, correlate, and analyze logs to generate alerts

D. To replace firewalls

5. What is a baseline in SOC monitoring?

A. The normal behavior of systems and network activity

B. A firewall configuration rule

C. A malware signature

D. A backup file

6. Scenario: An employee logs in at an unusual time outside working hours. What should a SOC analyst do?

A. Immediately block the user account

B. Ignore the activity

C. Verify if the activity is legitimate and investigate if suspicious

D. Delete system logs

7. What is alert fatigue in SOC monitoring?

A. A system update failure

B. Overload of alerts causing reduced analyst attention

C. A firewall malfunction

D. A backup process

8. Why is 24/7 monitoring important in a SOC?

A. It reduces internet usage

B. It allows employees to work remotely

C. It replaces antivirus software

D. It ensures continuous detection and response to threats

9. Scenario: Monitoring shows repeated failed login attempts on multiple accounts. What attack could this indicate?

A. Brute-force attack

B. Software installation

C. System backup

D. File compression process