Cybersecurity, SOC & Managed Services Assessment Practice Questions & Worked Solutions

Q1 Medium • Cybersecurity, SOC L1

In an email security header investigation, which mechanism specifically validates that an email was cryptographically signed by the sending domain's private key?

A SPF (Sender Policy Framework)

B DKIM (DomainKeys Identified Mail)

C DMARC (Domain-based Message Authentication)

D STARTTLS

Q2 Easy • SOC Operations, SIEM

A Tier-1 SOC analyst detects an alert: 'Multiple Failed Logins followed by Single Successful Login within 30 seconds' on a Domain Controller. What type of attack does this pattern most likely indicate?

A Distributed Denial of Service (DDoS)

B Brute Force / Password Spray Attack

C ARP Cache Poisoning

D SQL Injection

Q3 Medium • MSP, MSSP

What is the primary difference between a Managed Service Provider (MSP) and a Managed Security Service Provider (MSSP)?

A MSPs only sell hardware, whereas MSSPs only sell software licenses.

B MSPs focus on IT infrastructure availability, remote monitoring, and helpdesk triage, whereas MSSPs focus dedicatedly on 24/7 security monitoring, SOC operations, threat hunting, and compliance.

C MSPs only operate on-premise, while MSSPs only operate in the cloud.

D There is no difference; they are interchangeable commercial terms.

Q4 Easy • Networking, Ports

Which of the following ports is the default unencrypted listening port for Microsoft Remote Desktop Protocol (RDP), frequently targeted by external threat actors?

A Port 22

B Port 443

C Port 3389

D Port 8080

Q5 Medium • MITRE ATT&CK, SOC Analyst

In the MITRE ATT&CK framework, what tactic describes the adversary's efforts to keep access to systems across restarts, changed credentials, and other interruptions?

A Initial Access

B Persistence

C Privilege Escalation

D Lateral Movement

Q6 Medium • EDR, Cybersecurity

What does EDR stand for in endpoint cybersecurity, and how does it differ from traditional signature-based antivirus?

A Enterprise Data Recovery; it only recovers deleted files.

B Endpoint Detection and Response; it continuously records behavioral telemetry, process executions, and network connections to detect anomalous activity in real time beyond static signatures.

C External Domain Resolver; it performs DNS lookups.

D Encrypted Digital Routing; it encrypts network cables.

Q7 Medium • MSP, RMM

In a Remote Monitoring and Management (RMM) platform utilized by an MSP, what is an automated 'Patch Management Policy' designed to accomplish?

A Automatically format user hard drives once every quarter.

B Centrally test, approve, schedule, and verify OS and third-party software updates across hundreds of client endpoints with rollback safety.

C Forward all user emails to client management.

D Block all outgoing internet traffic during business hours.

Q8 Hard • Web Security, HTTP Headers

When a security analyst observes an HTTP response header containing 'strict-transport-security: max-age=31536000; includeSubDomains', what security control is being enforced?

A All incoming SQL queries are parameterized.

B Browsers are instructed to only communicate with the domain and its subdomains over HTTPS for the next 1 year (HSTS).

C Cross-Origin Resource Sharing (CORS) is disabled completely.

D Password complexity must be at least 31 characters.

Q9 Easy • Zero Trust, Network Security

Which of the following describes the core principle of Zero Trust Network Architecture?

A Trust any device located physically inside the office perimeter.

B Never trust, always verify: authenticate and authorize every user, device, and transaction continuously regardless of network location.

C Disable all firewall rules to eliminate network friction.

D Rely exclusively on password authentication without multi-factor tokens.

Q10 Medium • SIEM, SOC Analyst

What is the primary role of a SIEM (Security Information and Event Management) platform in a modern enterprise SOC?

A To generate invoices and billing statements for MSP customers.

B To aggregate, parse, correlate, and index log events from firewalls, servers, endpoints, and cloud services to trigger real-time security alerts.

C To physically repair broken laptop screens.

D To replace network routers with optical switches.

Q11 Easy • ITIL, MSP

Under standard ITIL incident response SLAs in a Managed IT environment, what is the key metric measured by MTTR?

A Mean Time to Reboot

B Mean Time to Resolve (or Repair) an incident from the moment it is acknowledged until normal service is restored.

C Maximum Threat Tracking Ratio

D Monthly Total Ticket Records

Q12 Easy • Cryptography, Data Protection

Which symmetric encryption cipher algorithm is recognized as the global standard approved by NIST for securing sensitive classified data?

A MD5

B DES (Data Encryption Standard)

C AES (Advanced Encryption Standard) with 128 or 256-bit keys

D Rot13

Cybersecurity, SOC & Managed Services Assessment Practice Questions (12)