Free Certified SOC Analyst (CSA) practice test: 30 questions with answers

A false positive is an alert on benign activity, which adds noise to the queue. A missed real attack is a false negative, while duplicate tickets and low severity labels are workflow and classification issues.

The indexer or data store holds events in a form that supports fast search and correlation, which is the core of SIEM retention. Forwarders collect, dashboards display, and ticket integrations route work, so none of them stores events for searching.

Checking the alert against the source event and its context decides whether it is real and how serious it is, which determines any escalation. Closing without review, escalating blindly, or reimaging before analysis risks missing evidence or wasting response effort.

Use cases need continuous care: they are built, tested, tuned for noise, deployed, and reviewed as the environment changes. Treating deployment as the end, retiring at the first alert, or limiting use cases to network devices each leaves gaps or wastes effort.

A maturity model gives a structured view of the SOC's people, processes, and technology, which is the basis for a roadmap of improvements. Pay bands, a single activity count, and replacing the incident response plan each misunderstand what maturity assessment is for.

MTTR measured from confirmation to containment reflects the speed of the response once a real incident is known. Alert volume, storage, and training completions describe workload or inputs rather than response speed.

Alert fatigue and staffing gaps are persistent problems that reduce the SOC's ability to find and respond to real threats. A documented escalation matrix and clear handover notes are good practice that helps the SOC, so they are not challenges.

Tier 1 analysts handle the incoming queue, triage alerts, and escalate what they cannot close or confirm. Hunters, forensic specialists, and management each work on later or different parts of the function.

SQL injection places attacker-controlled SQL into a query built from unvalidated input, which is the behaviour described. Cross-site scripting, denial of service, and session hijacking are distinct attack types that do not inject SQL into a database query.

An IoC is observable forensic evidence, such as a hash, domain, or address, that points to a compromise and can be searched for. Attacker motives, patch schedules, and normal login patterns are not indicators of compromise.

The Diamond Model describes an intrusion as a relationship between those four vertices, which helps analysts pivot from one piece of evidence to others. The other frameworks are governance, management, or web-risk references rather than intrusion analysis models.

Reconnaissance and weaponization are early stages of the kill chain, followed by delivery, exploitation, and the rest. Patch approval, asset disposal, and office relocation are business processes that are not stages of an attacker's intrusion.

Event ID 4624 in the Security log records a successful logon, which is central to tracing account use. Driver, spooler, and setup logs record other activity on the host.

Correlating events across devices depends on consistent timestamps, otherwise the sequence of an attack cannot be reconstructed. Time sync does not change file size, remove personal data, or replace normalization.

Normalization maps fields from different sources onto a shared schema, which makes correlation and searching across sources practical. Deduplication, encryption, and moving logs are separate operations that do not normalize the content.

Source address and port show where the connection came from, while destination address and port show what it was aimed at. Rule comments, firmware versions, and serial numbers describe the policy or hardware rather than the endpoints of the session.

Tactical intelligence describes how adversaries operate, which is what defenders need to build detections. Strategic reports, scan results, and asset inventories provide other kinds of information that do not describe adversary behaviour.

Threat hunting starts from a hypothesis and searches for activity that existing detections missed, which is what makes it proactive. Waiting for alerts, scheduled patching, and an annual scan are reactive or hygiene activities rather than hunting.

YARA rules describe textual and binary patterns that are used to classify and find malware in files and memory. CSV lists, spreadsheet macros, and slide templates are reporting formats that cannot match patterns in malware.

Indicator feeds provide concrete values, such as addresses and hashes, that can be matched and blocked immediately. Strategic reports, marketing newsletters, and geopolitical analysis inform decisions but are not directly actionable for blocking.

Once the spread is contained, eradication removes the attacker's footholds and malware before recovery begins. Preparation and detection come before containment, and the post-incident review comes after recovery.

Recovery restores systems from clean sources and verifies them before users return, with monitoring in place. Deleting logs, disabling monitoring, and publicizing attacker addresses destroy evidence, remove protection, or misdirect the response.

SOAR platforms automate and coordinate repeatable response steps across tools, under analyst control. A firewall, a log store, and a reporting replacement are different products that do not describe what orchestration provides.

An effective playbook tells responders when to start, what to do, who does it, and what to decide, which works under time pressure. Narrative history, a private copy, and an exhaustive tool list do not give responders usable steps.

Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR service, which collects data, detects threats, and automates response. The other products are productivity, device management, and collaboration tools.

Security Hub aggregates findings and compliance results from many accounts and security services into one view. S3 lifecycle rules, placement groups, and Lambda serve storage, placement, and compute purposes.

Security Command Center is the central place for findings and misconfigurations across Google Cloud. Storage lifecycle, preemptible instances, and Cloud Functions are compute and storage services rather than security posture tools.

Volatile data is lost at shutdown, so documenting state and capturing memory comes before any change to the host. Formatting, rebooting, and deleting temporary files each destroy evidence that the investigation depends on.

Dynamic analysis in an isolated sandbox records what the program does while keeping production systems separate from the risk. Running it on a domain controller, sharing it, or emailing it expose the production network to the sample.

Scheduled task definitions show what program will run, when, and under which account, which is direct evidence of scheduled persistence. Browser history, print spools, and wallpaper settings do not show scheduled execution.