Which metric should be used when evaluating the effectiveness and scope of a Security Operations Center?

What is the relationship between a vulnerability and a threat?

What is a difference between tampered and untampered disk images?

What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?

An analyst received an alert on their desktop computer showing that an attack was successful on the host.
After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?