QuestionQ23

Security Operations

A new security operations center (SOC) manager joins a team that struggles to meet service-level agreements (SLAs). The alert backlog continues to increase daily. Which of the following will the manager most likely need to do?

  • A Automate escalation.
  • B Improve the triage processes.
  • C Upgrade threat intelligence.
  • D Enhance the customer service response.
Explanation

A growing alert backlog combined with missed SLAs points to inefficiencies in how incoming alerts are being sorted, prioritized, and dispositioned. Improving the triage process — refining criteria for severity classification, filtering out noise/false positives, and ensuring analysts focus on the highest-priority alerts first — directly increases the rate at which alerts are cleared and helps the team meet SLA targets. Automating escalation only affects alerts after they have already been triaged and does not resolve the root bottleneck of alerts piling up before assessment; improving threat intelligence enhances context and accuracy but does not by itself speed up processing of the existing queue; and customer service response is not related to internal alert handling throughput.

Community Discussion

No comments yet. Be the first to start the discussion!