Final check — Security operations shift supervision

Answer the 10 questions. You need 80% or more to pass. You can retry as many times as you like.

Question 1What is the shift supervisor’s primary job, as framed in this course?To speak to the press before anyone elseTo close more tickets than the techniciansTo make the shift produce a reliable service within a written authorityTo rewrite the organisation’s cybersecurity policy each night

Question 2In CSF 2.0, how does this course treat Govern, Identify and Protect during an incident?As broader risk-management activities that prepare and support response, not as steps invented at 02:00As functions that replace Detect, Respond and RecoverAs the three official phases of incident response that the shift must complete in orderAs optional documentation to fill after the incident is closed

Question 3What should a useful shift handover emphasise?The total number of tickets openedLive incidents, running clocks, open decisions and degraded detectionsA complete export of raw alert logsPersonal opinions about each analyst

Question 4An escalation path should include at least…A requirement to wait until the queue is emptyWho is called, after how long, and with what minimum facts and requested decisionOnly a generic mailbox checked the next morningThe analyst’s personal mobile numbers, unwritten

Question 5According to SP 800-61 Rev. 3 as summarised in this course, incident response itself consists of…Detect, Respond and Recover, with lessons feeding Improvement in the Identify functionOnly Recover, once legal has been informedGovern alonePrepare, Detect, Analyze, Contain, Eradicate, Recover, Lessons learned, in that fixed order

Question 6Why does this course insist on a time-stamped decision log during containment?Because regulators require a printed book in every SOCSo the next shift and any later review can see who approved an action and when a clock startedTo replace the technical leadTo calculate bonuses

Question 7From when, according to the Commission CRA reporting page cited in this course, must manufacturers report actively exploited vulnerabilities and severe product-security incidents?1 January 2025There is no fixed date on that page11 September 202611 December 2027 only, together with all other CRA duties

Question 8A significant incident under NIS2, as summarised from the Directive, is notified to…The CSIRT or, where applicable, the competent authority of the Member StateThe shift supervisor’s personal emailThe vendor’s marketing teamENISA’s Single Reporting Platform only, in all cases

Question 9Which set of metrics does this course treat as useful for improvement?Social-media follower counts for the SOCTicket volume, average busyness, and a target to close everything before dawnTime to detect, time to contain, incidents that escaped the shift, handover defects and repeat root causesThe number of tools purchased that month

Question 10How should a dangerous overnight staffing gap be handled?Cancel detection for the rest of the nightPublish the gap on social mediaAbsorb it silently and treat endurance as a badge of dedicationEscalate it as an operational risk and log missed breaks or solo coverage of a major incident

Final check — Security operations shift supervision

Already paid?