Quiz: Building and Leading the Security Function
A 26-question self-check covering the chapter's organizational, operational, and leadership concepts. Several questions are tagged with the certification domain they map to — [Sec+] for CompTIA Security+ and [CISSP] for the (ISC)² CISSP — so certification candidates can self-assess. Answers and one-line explanations are at the end; try the whole quiz before checking.
Section 1 — Multiple choice (1 pt each)
1. [Sec+] The team responsible for continuous monitoring, detection, triage, and initial response to threats across an organization is the: A. red team B. Security Operations Center (SOC) C. GRC function D. change advisory board
2. Approximately how many full-time analysts are needed to keep a single SOC seat staffed 24/7, once you account for leave, sickness, and training? A. 1–2 B. 3 C. 5–7 D. 12–15
3. [CISSP] The near-universal structural fix that gives a CISO independence from the delivery-vs-security conflict of reporting to a CIO is: A. a larger budget B. a dotted line to the board's Audit/Risk Committee C. a vendor contract D. moving the SOC offshore
4. In the three-tier SOC model, the tier that proactively hunts for undetected threats and builds new detections so future occurrences are caught automatically is: A. Tier 1 B. Tier 2 C. Tier 3 D. the help desk
5. [Sec+] A service provider that brings its own detection technology and analysts and takes response actions on your behalf (not just alerting) is best described as: A. an MSSP B. an MDR provider C. a SIEM vendor D. a penetration tester
6. The classic complaint about a traditional MSSP is "alert shipping," which means: A. it deletes alerts B. it forwards alerts for you to investigate and act on, so you outsourced the watching but not the working C. it ships physical appliances D. it only works business hours
7. [CISSP] A documented, step-by-step procedure an analyst follows for a specific task (e.g., "investigate an impossible-travel login") is a: A. playbook B. policy C. runbook D. standard
8. The chapter calls the runbook "the unit of automation" because: A. runbooks cannot be automated B. a runbook is a procedure already written down step-by-step, which is the prerequisite for automating it with SOAR C. automation replaces all runbooks D. runbooks are written in Python
9. [Sec+] A collaborative exercise in which an offensive team emulates ATT&CK techniques while the defensive team detects in real time and immediately closes each exposed gap is called: A. a red-team engagement B. a tabletop C. purple teaming D. a bug bounty
10. In a purple-team exercise, a technique that is "logged but not alerted" indicates that the fix needed is: A. add a new log source / sensor B. write or tune a detection rule on data you already have C. fire the analyst D. nothing — it was caught
11. [CISSP] During a serious incident, the team most needs its leader to act as the: A. best individual technician B. incident commander providing calm and judgment C. note-taker D. media spokesperson
12. The hardest transition in security leadership described in the chapter is from: A. analyst to consultant B. doing the work (best individual contributor) to building the system and people that do the work C. blue team to red team D. on-prem to cloud
13. [Sec+] Which model multiplies a small central security team's reach by embedding non-security employees in business units with a dotted line back to the CISO? A. fully centralized B. fully distributed C. hybrid with security champions D. fully outsourced
Section 2 — True / False with justification (1 pt each)
For each, mark T or F and give a one-sentence reason.
14. "Analyst burnout can be fully resolved by the same detection-tuning that fixes alert fatigue."
15. [Sec+] "A two-person on-call rotation is a sustainable long-term arrangement for a SOC."
16. "In a talent shortage, retaining a trained analyst is generally cheaper than replacing one."
17. "Purple teaming ends with a report of what the blue team missed, but does not change the detections during the exercise."
18. "Where the CISO reports in the org chart has no meaningful effect on program maturity."
19. [CISSP] "An in-house SOC built around two irreplaceable senior analysts is an example of a single point of failure that defense in depth exists to avoid."
Section 3 — Fill in the blank (1 pt each)
20. A complete security program covers five functions: security operations, incident response/ hunting, security engineering/architecture, __, and security leadership.
21. [Sec+] The structural shortfall between the cybersecurity professionals organizations need and those available in the labor market is called the security __ gap.
22. The acronym SOAR stands for Security Orchestration, __, and Response.
23. The strategic choice of whether to staff a SOC internally, outsource it, or combine the two is called _ vs _ .
Section 4 — Short answer (2 pts each)
24. [CISSP] Explain why "org design is a security control," referencing the CISO's reporting line and the concept of a control owner from governance (Chapter 26).
25. A mid-size company cannot afford to staff 24/7 monitoring in-house but has a highly specialized, regulated environment where deep context is essential. Recommend a sourcing model and justify it, naming what you would keep in-house and what you would buy.
26. [Sec+] Distinguish alert fatigue from analyst burnout, name the layer at which each is fixed, and explain why a leader must work both.