200-201 Question 402
Select 2A Security Operations Center (SOC) team is analyzing an incident and wants to improve their metrics for scope analysis. Which key metrics can directly impact the efficiency of identifying and understanding the scope of the incident?
- A
Time to Detect (TTD)
- B
Time to Respond (TTR)
- C
Time to Containment (TTC)
- D
Time to Resolution (TTR)
- E
False Positive Rate
Show answer and explanation
Correct answers: A, C
Explanation
Metrics such as Time to Detect (TTD) and Time to Containment (TTC) are crucial for understanding and limiting the scope of a security incident. TTD ensures that the SOC identifies incidents promptly, while TTC ensures that the incident is contained quickly to prevent further escalation. These metrics directly affect the SOC's ability to scope, analyze, and manage incidents efficiently.
- A. Correct.
Time to Detect (TTD) refers to the time taken to identify an incident, which is critical for understanding the scope of an attack quickly and initiating the response process.
- B. Incorrect.
Time to Respond (TTR) is more focused on the actions taken after detection, which is less directly related to initial scope analysis.
- C. Correct.
Time to Containment (TTC) measures how quickly the SOC can limit the spread of an incident, which is directly relevant to managing and understanding the scope of the event.
- D. Incorrect.
Time to Resolution (TTR) is about fully resolving an incident, which occurs after scope analysis and containment, making it less relevant to this particular context.
- E. Incorrect.
False Positive Rate measures the accuracy of detection systems but does not directly relate to the efficiency of scope analysis.