Which two activities are critical for an SOC analyst to investigate and mitigate security incidents effectively? (Choose two)

The primary function of a Security Operations Center (SOC) analyst is to identify, analyze, and respond to cybersecurity threats. This is achieved through continuous detection and investigation activities. Monitoring network traffic for anomalies allows analysts to spot unusual patterns that may indicate a compromise or attack in progress. Concurrently, reviewing and correlating security alerts from various tools (e.g., SIEM, IDS/IPS, EDR) is essential for piecing together evidence, understanding the scope of an incident, and distinguishing real threats from false positives. These two activities form the core of the detection and analysis phase of incident response.

A. Configuring access control lists (ACLs): This is a preventative control typically managed by network administrators or security engineers, not a primary investigation activity for a SOC analyst.

B. Installing anti-virus software: This is an endpoint security or system administration task focused on prevention, rather than the active investigation and mitigation of ongoing incidents.

C. Performing routine data backups: This is a critical recovery function handled by system or backup administrators, not a direct task for a SOC analyst during an investigation.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (Special Publication 800-61 Rev. 2).

Section 3.2, "Detection and Analysis," details that this phase involves analyzing data from various sources to identify incidents. It states, "The most common sources of precursors and indicators are alerts from IDPSs, antivirus software, and file integrity checking software... Information from network traffic... is also a useful source of data for incident analysis." (p. 23). This directly supports monitoring network traffic (D) and analyzing alerts (E).

2. Carnegie Mellon University, Software Engineering Institute (SEI). (2014). Ten Strategies of a World-Class Cybersecurity Operations Center (CMU/SEI-2014-TR-011).

Strategy 2, "Situational Awareness," emphasizes the need to "collect data from a variety of sources" and "perform analysis" to understand the operational environment and detect threats. This aligns with monitoring traffic and correlating alerts. (p. 11).

Strategy 4, "Incident Management," describes the process of handling incidents once detected, which begins with the analysis of alerts and other data sources. (p. 15).

3. Cisco. (n.d.). What Is a Security Operations Center (SOC)?. Official Vendor Documentation.

In the section "How a SOC works," Cisco describes the foundational activities: "A SOC team is responsible for the ongoing, operational component of enterprise information security... The SOC team’s main goal is to detect, analyze, and respond to cybersecurity incidents... A SOC monitors and analyzes activity on networks, servers, endpoints, databases, applications, websites, and other systems." This directly validates monitoring (D) and alert analysis (E) as core SOC functions.