A SOC team lead occasionally collects some DNS information for investigations. The team lead assigns this task to a new junior analyst. Which of the following is the best way to relay the process information to the junior analyst?

Writing a step-by-step document on a team wiki creates a formal Standard Operating Procedure (SOP) or a playbook. This is the most effective method for knowledge transfer in a Security Operations Center (SOC) because it ensures the process is standardized, consistent, and repeatable, regardless of which analyst performs the task. This approach establishes a centralized, version-controlled knowledge base that can be easily updated and referenced by all team members, reducing the likelihood of errors and improving operational efficiency. Documented procedures are a cornerstone of a mature security operations program.

A. This method of informal training is not scalable, can lead to inconsistencies, and creates no lasting documentation for future reference or auditing.
B. Using an external, unvetted website is unreliable as the process shown may not align with the team's specific tools, policies, or environment.
C. Assigning process development to a junior analyst is inefficient and introduces a high risk of error, inconsistency, and deviation from established best practices.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide.

Section 3.1

"Preparation

" Page 19: This section states that the preparation phase should include "preparing a set of incident handling procedures (a playbook) to ensure that incidents are handled in a consistent

repeatable manner." This directly supports the creation of a documented

step-by-step process (Option D) as a fundamental best practice.

2. Carnegie Mellon University

Software Engineering Institute. (2017). Best Practices for Security Operations Centers (SOCs): A Multidisciplinary Perspective.

Section 3.2

"Processes

" Page 10: The document emphasizes that "Well-defined

documented

and repeatable processes are a key element of a successful SOC." It further explains that these documented processes (or playbooks) guide analysts in their daily tasks

ensuring consistency and quality. This aligns perfectly with creating a wiki document for the junior analyst.