SOC Analyst

Sample question 1

A SOC analyst at a regional healthcare network reviews six months of SIEM alert history as part of the team's routine trend analysis. Failed VPN login attempts have risen 40 percent month over month, but the failures are spread thin across many different accounts, so no single account crosses the existing brute-force alert threshold. What should the analyst do next?

1. A.Close the observation without further review, since no single account crossed the alert threshold and the SIEM would have flagged a genuine attack.
2. B.Force an immediate password reset for every VPN user across the organization before completing any further analysis of the login pattern.
3. C.Aggregate the failed logins across accounts and time to check for a distributed, low-and-slow credential attack, then report the trend to leadership with supporting evidence.
4. D.Hold the observation for the next scheduled quarterly compliance report, since it has not yet triggered an active incident ticket.

Sample question 2

Meridian Financial's database administrator has standing authorization to export nightly reporting extracts to a vendor over SFTP, typically 1 to 3 GB per night. Reviewing six weeks of export logs, a SOC analyst notices the DBA has added a second export most nights, consistently sized between 4.6 and 4.9 GB, just under the DLP tool's 5 GB per-transfer alert threshold, and that these second exports are uploaded to a personal GitHub Gist rather than sent over the vendor SFTP path. Which finding is the strongest indicator that this is deliberate evasion of monitoring controls rather than a routine change in export volume?

1. A.The DBA's combined nightly export volume, across both transfers, is higher than it was six months ago.
2. B.The second export tends to occur on nights when the DBA also logged long hours in the ticketing system.
3. C.The second export's size stays just under the DLP threshold night after night while it moves through an unmonitored personal channel.
4. D.Both the vendor SFTP export and the second export draw from the same finance reporting tables the DBA normally works with.

Sample question 3

A threat intelligence feed the organization subscribes to issues an urgent bulletin describing a new campaign that targets Java-based CI/CD orchestration servers through an exposed management port, and lists eight IP addresses as active command-and-control infrastructure. The SOC analyst must decide how to respond. The organization's CI/CD orchestrator runs on a different, non-Java platform, and ninety days of firewall logs show no inbound or outbound traffic involving any of the eight listed IPs. Applying threat intelligence principles and practices, what is the most appropriate next step?

1. A.Record the eight indicators in the threat intelligence platform for future correlation, note that the targeted platform and the observed traffic pattern do not match the organization's environment, and prioritize the bulletin lower than intelligence describing threats to the organization's actual technology stack.
2. B.Block the eight IP addresses at the network perimeter immediately and treat the bulletin as top priority, even though the campaign targets a different platform and no matching traffic has appeared, since any subscribed feed's command-and-control indicator should be acted on the same way regardless of relevance.
3. C.Discard the bulletin and do not record the eight indicators anywhere in the threat intelligence platform, since the campaign targets a different CI/CD platform and no matching traffic has appeared, and a mismatch on both counts means the intelligence has no further value worth preserving.
4. D.Forward the eight IP addresses to the network team for blocking, but make no changes to the CI/CD orchestrator's own exposed management interfaces, since the platform mismatch and ninety days without matching traffic together already confirm the environment was never exposed to this campaign.