Patrick manages a security operations team of six analysts who need to provide 24-hour per day coverage. The team is continuously overwhelmed with the amount of security events they each need to triage, analyze, and respond to every day. Patrick wants to enable his team to focus on the most critical incidents, and not get distracted by low priority events. Patrick's leadership team agrees to increase his budget to hire one more person. What is the best way for Patrick to allocate his budget?

• A.Hire a third party incident response firm to supplement the team during major incidents.
• B.Hire a detection engineer to create detection content for more security tools.
• C.Hire one more full-time analyst to float between a different shift each day.
• D.Hire a SOAR engineer to develop new playbooks for automating responses.

Comment: *

Name: *

Email: *

Verification: *

A SOC engineer has configured a data feed of firewall logs, however the log feed only contains the basic informational fields of timestamp, src_ip, src_port, dst_ip, dst_port, action, and protocol.
Which of the following reflects the best practice for an ideal enrichment strategy?

• A.Limit enrichment to external IPs only, as internal IPs are generally considered trusted and don't require additional enrichment.
• B.Enrich firewall logs from internal asset databases to add business context, role, and ownership of source and destination IPs.
• C.Avoid integrating third-party threat intel during enrichment to reduce the complexity of the pipeline.
• D.Enrich firewall logs only when they trigger alerts to conserve system resources.

Comment: *

Name: *

Email: *

Verification: *

What strategies enable data-driven approaches to evaluating tool efficacy? (Choose all that apply.)

• A.Clearly defined outcomes and success criteria
• B.Relying on public testimonials and vendor marketing materials
• C.Early identification of prioritized requirements and use cases
• D.Continuous operational monitoring and metrics collection

Comment: *

Name: *

Email: *

Verification: *

What distributed computing model can be used to enable analysis of data closest to the data source for real-time monitoring?

• A.Middle computing
• B.Supercomputing
• C.Edge computing
• D.General purpose computing

Comment: *

Name: *

Email: *

Verification: *

What type of data does OpenTelemetry provide that the security team can use during an investigation?

• A.SBOM
• B.Threat path
• C.Normalization
• D.Traces

Comment: *

Name: *

Email: *

Verification: *