Question 148
Main Page
A simulation test shows SOC staff relying on outdated procedures. What should follow?
A. Suspend the test
B. Replace the team
C. Update documentation and conduct refresher training
D. Increase SIEM alert thresholds
Answer: Update documentation and conduct refresher training
Outdated playbooks must be revised and reinforced with training to ensure proper response.