Senior management asks whether the security operations center (SOC) would actually detect and respond to a skilled, stealthy attacker. Which assessment BEST answers this question?
Select an answer to reveal the explanation.
Short Explanation
You don't learn whether the guard dog barks by reading its training certificate; you send someone over the fence. A red team plays the burglar so you see what your SOC really catches. The trap is the tabletop: it tests what you'd say you'd do, not what you'd actually notice.
Full Explanation
Management's question is about real detection and response capability against a capable adversary. A red team exercise answers it directly: an authorized team emulates realistic attacker tactics against defined objectives, usually without the defenders being told, so the organization observes what the SOC detects, how quickly it escalates and how effectively it responds. The results show gaps in visibility, detection logic and response that other methods cannot. A vulnerability scan identifies known weaknesses on internet-facing systems; it does not attempt stealthy compromise or test whether anyone notices, so it says nothing about the SOC's performance. Reviewing documented procedures evaluates design and readiness on paper but cannot show whether alerts would actually fire or be acted on. A tabletop exercise is valuable for testing decision making and coordination, but analysts discuss what they would do in a scenario they already know about, so it cannot measure detection. Exam caveat: red team exercises need senior authorization, clear rules of engagement and a limited group aware of the test to manage operational risk and to deconflict with genuine incidents. Operational check: after the exercise, map each attacker action to whether it was detected, when, and what response followed, and track remediation of the gaps found.