312-39V2: Certified SOC Analyst v2

Question

A mid-sized financial institution’s Security Operations Center (SOC) is struggling with an overwhelming volume of security alerts. The small team receives thousands of daily notifications, many based on Indicators of Compromise (IOCs), such as suspicious IP addresses, hashes, and domains. However, these alerts lack essential context about whether they genuinely threaten the organization. Analysts spend too much time pursuing low-priority incidents while more serious threats may remain unnoticed. In addition, the team lacks the tools and intelligence needed to correlate IOCs with real-world threats, making prioritization nearly impossible. Consequently, alert fatigue is increasing, reducing efficiency and raising the risk of overlooking an actual attack. Which of the following presents the greatest challenge in this environment?

Explanation

An IOC is a technical indicator, whereas cyber threat intelligence provides the context required to evaluate relevance, confidence, adversary activity, and operational priority. Without that context and correlation capability, analysts cannot reliably determine which IOC-based alerts represent material threats. CISA notes that IOC feeds can be too voluminous and noisy and may contain little or no context, requiring substantial effort to determine relevance and an appropriate response.

Learn more

Operational Value of Indicators of Compromise White Paper

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ86

Community Discussion