Practise vocabulary for SIEM alerts, threat hunting, IOCs, MITRE ATT&CK, and SOC analyst communication.
0 / 6 completed
1 / 6
An Indicator of Compromise (IOC) is:
IOC examples: a known malware file hash, a C2 domain in DNS logs, a suspicious IP in firewall logs, a registry persistence key. SOC analysts use IOCs to search for evidence of intrusion across the environment.
2 / 6
SIEM in a SOC context stands for and means:
A SIEM (e.g. Splunk, Microsoft Sentinel, IBM QRadar) ingests logs from firewalls, endpoints, servers, and cloud — correlating events against detection rules to generate alerts SOC analysts investigate.
3 / 6
Alert triage in a SOC means:
Triage is the initial assessment: is this alert a real threat? SOC analysts examine context (user, asset, time, behaviour baseline) to make a disposition: close as false positive, escalate for incident response, or continue investigation.
4 / 6
The MITRE ATT&CK framework is used to:
MITRE ATT&CK is a knowledge base of adversary behaviour: Tactics (why) → Techniques (how) → Sub-techniques (specific method). Example: Tactic: Credential Access, Technique: OS Credential Dumping, Sub-technique: LSASS Memory.
5 / 6
Threat hunting in a SOC differs from alert triage in that threat hunters:
Threat hunting is proactive: 'If an attacker used living-off-the-land techniques, I would expect to see PowerShell downloading payloads from unusual domains. Let me query DNS logs for that pattern.' It finds what detection rules miss.
6 / 6
Dwell time in a security incident refers to:
Industry reports often cite dwell times of weeks to months — meaning attackers operated undetected for extended periods. Reducing dwell time is a key SOC effectiveness metric: shorter dwell = less damage before containment.
What does the "SOC Analyst Vocabulary" exercise practise?How many questions are in this exercise?
This exercise has 6 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Cybersecurity category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "SOC Analyst Vocabulary" part of a larger series?
Yes — it's one exercise in the Cybersecurity category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Cybersecurity category page for related exercises, or browse the main Exercises hub for other IT English topics.