SOC Level 1 · CyberQuiz

Q1 Easy 10 pts

What does SIEM stand for?

Secure Internet Email Manager Security Information and Event Management System Integrity & Endpoint Monitoring Signal Intelligence Event Model

Q2 Easy 10 pts

An alert that fires on activity that is actually benign is a:

True positive False positive False negative True negative

Q3 Medium 15 pts

A real attack that goes UNDETECTED is a:

False positive False negative True positive True negative

Q4 Medium 15 pts

SOC analysts map attacker behavior to the MITRE ____ framework of tactics & techniques.

Q5 Medium 15 pts

Windows Event ID 4625 indicates:

Successful logon Failed logon Log cleared Service installed

Q6 Easy 10 pts

Windows Event ID 4624 indicates:

Failed logon Successful logon Account lockout New process

Q7 Medium 15 pts

The documented record of who handled evidence and when is the chain of ____ .

Q8 Easy 10 pts

EDR stands for:

Encrypted Data Router Endpoint Detection and Response Event Data Repository External Domain Registry

Q9 Medium 15 pts

SOAR platforms primarily provide:

Storage Security Orchestration, Automation and Response (automated playbooks) A firewall A VPN

Q10 Medium 15 pts

An IDS differs from an IPS in that an IDS:

Blocks traffic inline Detects and alerts but does not block by itself Encrypts traffic Routes packets

Q11 Easy 10 pts

An IOC (Indicator of Compromise) is:

A firewall brand An artifact (hash, IP, domain) suggesting a breach A compliance form A GPU metric

Q12 Hard 20 pts

On the Pyramid of Pain, which indicator is HARDEST for attackers to change?

Hash values IP addresses Domain names TTPs (tools, tactics, procedures)

Q13 Medium 20 pts

Regular, fixed-interval callbacks from a host to an external server suggest:

Normal browsing C2 beaconing A backup job DNS caching

Q14 Medium 15 pts

The FIRST action when triaging a new alert is usually to:

Immediately reimage the host Gather context and verify whether it's a true positive Notify the press Delete the logs

Q15 Medium 15 pts

SPF, DKIM and DMARC are used to combat:

Ransomware encryption Email spoofing/phishing SQL injection DDoS

Q16 Hard 20 pts

The security tool language for writing pattern-matching malware rules by content is ____ .

Q17 Hard 20 pts

Sigma rules are:

Firewall ACLs A generic, SIEM-agnostic format for detection rules over logs A malware family An encryption cipher

Q18 Medium 15 pts

Suricata and Snort are examples of:

EDR agents Network IDS/IPS engines Password crackers Ticketing systems

Q19 Medium 15 pts

MTTD in SOC metrics means:

Mean Time To Deploy Mean Time To Detect Max Time To Decrypt Mean Time To Delete

Q20 Medium 15 pts

MTTR typically means:

Mean Time To Respond/Remediate Max Transfer Time Rate Mean Time To Reboot Minimum Threat Threshold Ratio

Q21 Easy 10 pts

A SOC 'playbook' is:

A password list A documented, repeatable procedure for handling a specific alert/incident type A malware sample A network diagram

Q22 Medium 15 pts

The typical incident-response lifecycle (NIST) begins with:

Eradication Preparation Recovery Lessons learned

Q23 Medium 15 pts

'Containment' in incident response aims to:

Publicly disclose the breach Limit the spread/impact of an incident Delete all logs Increase bandwidth

Q24 Medium 15 pts

Alert fatigue is a risk because:

Alerts are free Too many (often false) alerts cause analysts to miss real ones It speeds triage It improves accuracy

Q25 Medium 20 pts

UEBA detects threats by:

Blocking all traffic Baselining normal user/entity behavior and flagging anomalies Encrypting logs Scanning email only

Q26 Hard 20 pts

Sysmon is used to:

Encrypt disks Provide detailed Windows telemetry (process creation, network, etc.) for detection Route packets Manage passwords

Q27 Medium 15 pts

A sudden spike in outbound data to an unknown host may indicate:

A backup Data exfiltration A patch Normal DNS

Q28 Medium 15 pts

DLP tools are designed to:

Speed up networks Detect/prevent sensitive data from leaving the organization Encrypt backups only Manage tickets

Q29 Medium 15 pts

Many repeated failed logons followed by a success suggests:

A patch cycle A successful brute-force / password-spray attack Normal login A DNS lookup

Q30 Medium 20 pts

Threat hunting is best described as:

Waiting for alerts Proactively searching for undetected threats based on hypotheses Installing antivirus Patching servers

Q31 Medium 15 pts

The model describing attack stages from recon to actions-on-objectives is the Cyber Kill ____ .

Q32 Medium 15 pts

Log timestamps across systems should be normalized to:

Local time only A single time zone (usually UTC) via synchronized clocks (NTP) Random values Epoch strings only

Q33 Medium 15 pts

'Enrichment' of an alert means:

Deleting fields Adding context (geo-IP, threat intel, asset owner) to speed triage Encrypting it Ignoring it

Q34 Medium 15 pts

A honeypot is:

A backup server A decoy system meant to attract and study attackers A password vault A load balancer

Q35 Medium 15 pts

CVSS is used to:

Encrypt data Score the severity of vulnerabilities (0–10) Manage tickets Detect phishing

Q36 Hard 20 pts

Which log source best shows PROCESS creation on Windows?

DHCP logs Security/Sysmon Event ID 4688/1 (process creation) Router logs SMTP logs

Q37 Hard 20 pts

NetFlow data provides:

Full packet payloads Metadata about network connections (who talked to whom, how much) Disk contents Passwords

Q38 Medium 15 pts

A PCAP file contains:

A password hash Captured raw network packets A registry hive A malware signature

Q39 Hard 20 pts

First responder rule: preserve evidence by:

Rebooting immediately Avoiding actions that alter volatile data before it's captured Deleting temp files Formatting the disk

Q40 Medium 15 pts

A correlation rule in a SIEM:

Encrypts logs Links multiple events into a single meaningful alert Deletes duplicates only Blocks IPs

Q41 Easy 10 pts

Tiered SOC roles: which handles initial alert triage?

Tier 3 / threat hunter Tier 1 analyst The CISO The auditor

Q42 Easy 10 pts

Escalation to Tier 2/3 is appropriate when:

The alert is a confirmed false positive The incident needs deeper investigation beyond L1 scope It's lunchtime The log rotates

Q43 Medium 15 pts

Ransomware activity often shows:

Slow, quiet behavior Rapid mass file modifications/renames and ransom notes Only outbound email No disk activity

Q44 Medium 15 pts

Analyzing a suspicious email, you inspect the:

Font size Full headers, sender domain, links and attachments Screen brightness Battery level

Q45 Medium 15 pts

A detection 'use case' is:

A laptop bag A defined scenario the SOC wants to detect, with data sources and logic A password A firewall port

Q46 Medium 15 pts

Baselining is important because anomalies are defined relative to:

Random noise What 'normal' looks like for that environment The vendor default The CEO's schedule

Q47 Medium 15 pts

Log RETENTION policy matters because:

Logs are decorative Investigations may need historical data; too-short retention loses evidence It saves electricity It speeds the CPU

Q48 Easy 10 pts

A 'true positive' alert means:

Benign activity flagged Malicious activity correctly detected Nothing happened The sensor failed

Q49 Medium 15 pts

Threat intelligence 'TTPs' stands for:

Time, Ticket, Priority Tactics, Techniques and Procedures Total Threat Prevention Transport Telemetry Protocol

Q50 Medium 15 pts

The best outcome of a post-incident review is:

Assigning blame Lessons learned that improve detection and response Deleting the report Ignoring the root cause