Chapter 1: Introduction to SOC & AI - Quiz¶

Correct Answer: B) Initial alert triage, enrichment, and escalation

Explanation: Tier 1 analysts serve as the first line of defense, monitoring SIEM dashboards, performing initial triage to determine if alerts are true positives or false positives, gathering basic enrichment data, and escalating complex or high-severity incidents to Tier 2. Threat hunting and advanced analysis are Tier 3 responsibilities, while detection engineering is a specialized role.

Reference: Chapter 1, Section 1.2 - SOC Team Structure

Correct Answer: B) Enrich the alert with threat intelligence, user context, and historical login patterns

Explanation: Before taking any action, a Tier 1 analyst should gather context: Is this user known to use VPNs? Does the account have a history of traveling? Are these IPs associated with known VPN services or threat actors? Enrichment provides the necessary information to make an informed triage decision. Immediately disabling accounts without context can disrupt legitimate business activity.

Reference: Chapter 1, Curiosity Hook - The 3 AM Alert

Correct Answer: C) Mean Time to Detect (MTTD)

Explanation: MTTD measures detection speed from the moment an incident occurs to when the SOC identifies it. MTTA measures acknowledgment time after an alert fires, MTTR measures response/remediation time, and Dwell Time is the total period an attacker remains undetected (which includes MTTD but extends through investigation and eradication).

Reference: Glossary - Mean Time to Detect

Correct Answer: B) 50 hours

Explanation: - Total alerts: 500/day - False positives: 500 × 0.60 = 300 - Time per alert: 10 minutes - Total FP time: 300 × 10 = 3,000 minutes = 50 hours

This demonstrates the severe impact of alert fatigue. A team of even 5 analysts would struggle to handle this volume, leading to burnout and missed true threats.

Reference: Chapter 1, Section 1.3 - Challenge 1: Alert Fatigue

Correct Answer: B) LLMs can generate plausible but incorrect information, such as fabricated ATT&CK technique IDs

Explanation: Hallucination occurs when Large Language Models (LLMs) confidently produce false information that sounds legitimate. For example, an LLM might invent a MITRE ATT&CK technique like "T1234.567 - Advanced Persistent Exfiltration" that doesn't exist. This is dangerous in SOC operations because analysts may waste time investigating non-existent threats or apply incorrect response procedures.

Mitigation: Use Retrieval-Augmented Generation (RAG) to ground LLM outputs in verified sources, implement guardrails that validate outputs against known databases, and train analysts to verify LLM suggestions.

Reference: Chapter 1, Section 1.5 - Limitation 3: Hallucination & Misinformation

Correct Answer: B) To provide a common language for describing adversary behavior and measuring detection coverage

Explanation: MITRE ATT&CK is a knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. SOC teams use it to: 1. Map detection rules to specific techniques 2. Identify coverage gaps 3. Communicate about threats using standardized terminology (e.g., "T1059.001 - PowerShell") 4. Support purple teaming exercises

It does NOT replace SIEMs or auto-generate rules, but serves as a framework for detection engineering.

Reference: Chapter 1, Section 1.7 - The MITRE ATT&CK Framework

Correct Answer: C) Level 3: Defined

Explanation: According to the SOC Maturity Model: - Level 1 (Initial): Basic monitoring, SIEM deployed, manual triage, high false positives - Level 2 (Developing): Structured processes, documented runbooks, tier structure - Level 3 (Defined): Proactive hunting, threat intel integration, automation, purple teaming - Level 4 (Managed): AI-assisted triage, continuous improvement, predictive capabilities - Level 5 (Optimizing): Advanced AI, zero-trust architecture, industry benchmarking

Most organizations operate at Level 2-3.

Reference: Chapter 1, Section 1.1 - SOC Maturity Levels

Correct Answer: C) It reduces Mean Time to Acknowledge by pre-sorting high-confidence threats

Explanation: AI-augmented alert triage accelerates the detection-to-response cycle by automatically scoring alerts based on multiple contextual factors (threat intelligence matches, user risk scores, asset criticality, behavioral baselines). High-score alerts (e.g., 89/100) are immediately surfaced to analysts, while low-score alerts can be deprioritized or auto-closed.

Benefits: - Reduces MTTA by highlighting genuine threats - Provides consistency across analyst shifts - Handles alert volume spikes

Important: AI does NOT eliminate false positives entirely, replace analysts, or prevent all breaches. Human judgment remains essential.

Reference: Chapter 1, Section 1.4 - Use Case 1: Alert Triage Acceleration

Correct Answer: B) SOAR playbooks auto-block legitimate IPs or services based on false positives

Explanation: Over-automation without proper guardrails can cause significant business disruption. For example:

Scenario: A SOAR playbook automatically blocks IPs flagged by an ML model. The model incorrectly identifies a legitimate partner VPN as C2 infrastructure and auto-blocks it, disrupting partner access and causing business impact.

Mitigation Strategies: - Implement approval gates for high-impact actions (blocking critical IPs, disabling accounts) - Set confidence thresholds (e.g., auto-block only if ML score > 95%) - Implement rollback mechanisms (auto-unblock after 24 hours if not confirmed malicious) - Require human review for edge cases

Reference: Chapter 1, Section 1.5 - Risk: Over-Automation Without Human Oversight

Correct Answer: C) False positive rate decreased from 60% to 35% and MTTA decreased from 12 minutes to 6 minutes

Explanation: MegaCorp's SOC faced: - Problem: 300 alerts/day, 60% FP rate, MTTA of 12 minutes, high analyst turnover

AI Intervention: 1. ML alert scorer trained on 6 months of labeled alerts 2. Auto-enrichment (threat intel lookups, user context) 3. LLM copilot for runbook suggestions

Results After 3 Months: - FP rate: 60% → 35% (better tuning informed by ML insights) - MTTA: 12 min → 6 min (pre-scored alerts + auto-enrichment) - Analyst satisfaction: +25%

Lesson: AI augments analysts by handling repetitive tasks, enabling them to focus on genuine threats.

Reference: Chapter 1, Mini Case Study - Improving Triage at MegaCorp

Correct Answer: B) Organizations lack sufficient labeled training data for rare attack types

Explanation: Ground truth scarcity is a fundamental challenge in security ML:

Problem: Most organizations don't have thousands of labeled true positive incidents for every attack type. Security events are rare (especially sophisticated attacks), making it difficult to train robust models.

Impact: - Models may overfit to the limited examples they've seen - Poor detection of rare or novel attack techniques - High false positive rates on edge cases

Mitigation: - Use threat intelligence and synthetic data augmentation - Start with high-volume use cases (e.g., phishing, brute force) - Implement continuous retraining as new incidents are confirmed - Combine ML with signature-based and behavioral detections

Reference: Chapter 1, Section 1.5 - Limitation 1: Ground Truth Scarcity

Correct Answer: C) Developing AI-powered tools to evade other organizations' security controls

Explanation: This textbook maintains a strictly defensive ethical approach:

✅ Ethical AI Uses: - Detect and defend against attacks - Understand attacker TTPs to build better detections - Safe deployment of AI with guardrails - Protect organizational assets and data

❌ Unethical/Out of Scope: - Exploit vulnerabilities or develop exploits - Malware development or weaponization - Techniques for evading defensive controls - Offensive hacking or penetration of other organizations

Why This Matters: AI amplifies capabilities. Defensive AI protects; offensive AI can cause harm. SOC operations focus exclusively on defense.

Reference: Chapter 1, Section 1.6 - Ethical & Safety Considerations

Correct Answer: B) Deep investigation, timeline reconstruction, and coordination with IT for containment

Explanation: Tier 2 Incident Responders handle: - Deep investigation of escalated incidents - Timeline reconstruction and root cause analysis - Coordination with IT teams for containment actions - Threat hunting based on intelligence - Mentoring Tier 1 analysts

Typical Metrics: - Mean Time to Respond (MTTR): < 2 hours - Investigation depth and accuracy - Successful containment rate

Tier 1 monitors dashboards and performs initial triage. Tier 3 handles threat hunting, advanced malware analysis, detection engineering, and architecture.

Reference: Chapter 1, Section 1.2 - Tier 2: Incident Responders

Correct Answer: B) Adversarial evasion

Explanation: Adversarial evasion occurs when attackers intentionally manipulate features to bypass ML-based detections.

Example: - Detection: ML model flags PowerShell malware based on high entropy (encrypted/obfuscated code) - Evasion: Attacker adds benign-looking comments and variable names to reduce entropy - Result: Model misclassifies malware as benign

Mitigation: - Defense in depth: Combine ML with signature-based and behavioral detections - Adversarial training: Train models on adversarially modified samples - Explainability: Understand which features drive predictions to detect suspicious manipulations - Monitor for evasion patterns: Unusual padding, benign strings in otherwise suspicious contexts

Reference: Chapter 1, Section 1.5 - Limitation 2: Adversarial Evasion

Correct Answer: B) AI augments analysts by handling repetitive tasks, but human judgment remains essential

Explanation: This aligns with the core philosophy of AI-augmented SOC operations:

Reality: - AI excels at repetitive, high-volume tasks (alert enrichment, log correlation, query generation) - Human analysts excel at creativity, contextual understanding, and handling novel threats - AI accelerates workflows but doesn't replace human decision-making

Common Misconceptions Debunked: - "AI will replace analysts" → FALSE. AI handles the 80% that's repetitive; humans handle the complex 20% - "AI models are always right" → FALSE. ML models make predictions based on training data and can be wrong - "Set and forget" → FALSE. AI requires continuous monitoring, retraining, and validation

Best Practice: Use AI to augment human capabilities, not replace them.

Reference: Chapter 1, Section 1.4 - AI in Security Operations: Opportunities and Common Misconceptions