Which SOC tool is specifically designed to detect and alert on suspicious network traffic patterns?

Intrusion Detection System (IDS)

Endpoint Detection and Response (EDR)

A SOC manager is evaluating the team's performance and notices that Tier 1 analysts are spending too much time on complex investigations that should be escalated to Tier 2. This is causing delays in triaging new alerts. Which role adjustment would best address this issue?

Assign Tier 2 analysts to also perform Tier 1 triage duties.

Reduce the number of alerts by disabling more SIEM rules.

Clarify the escalation criteria and train Tier 1 analysts to escalate complex alerts promptly.

Promote all Tier 1 analysts to Tier 2.

A newly formed SOC has basic monitoring in place, but the team frequently misses alerts because there is no formal process for prioritizing them. The SOC manager wants to improve the SOC's maturity. Which initiative should be prioritized first?

Purchase an advanced threat intelligence platform to improve detection.

Hire additional junior analysts to monitor more screens.

Immediately implement a full incident response plan with detailed playbooks.

Develop and document a formal alert triage and prioritization procedure.

A SOC uses a SIEM to collect logs from firewalls, endpoints, and authentication servers. The team is overwhelmed by thousands of daily alerts, many of which are false positives. The SOC manager wants to improve the signal-to-noise ratio without losing visibility into genuine threats. Which action should the SOC take first?

Switch to a different SIEM platform that claims better out-of-the-box detection.

Disable all correlation rules that generate more than 10 alerts per day.

Tune the SIEM correlation rules to reduce known false positives and adjust thresholds based on observed baseline behavior.

Increase the number of SOC analysts to manually review all alerts.

What is the primary purpose of a Security Information and Event Management (SIEM) system in a SOC?

To scan endpoints for malware and quarantine infected files

To aggregate and correlate log data from multiple sources to detect security incidents

To block malicious network traffic in real time

To manage user identities and access permissions

GIAC Security Leadership

Domain 3Objective 1

Managing a Security Operations Center GSLC Practice Questions (Page 1)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 1–5

1foundation · easy
Which SOC tool is specifically designed to detect and alert on suspicious network traffic patterns?
Select an answer first
2application · medium
A SOC manager is evaluating the team's performance and notices that Tier 1 analysts are spending too much time on complex investigations that should be escalated to Tier 2. This is causing delays in triaging new alerts. Which role adjustment would best address this issue?
Select an answer first
3application · medium
A newly formed SOC has basic monitoring in place, but the team frequently misses alerts because there is no formal process for prioritizing them. The SOC manager wants to improve the SOC's maturity. Which initiative should be prioritized first?
Select an answer first
4application · medium
A SOC uses a SIEM to collect logs from firewalls, endpoints, and authentication servers. The team is overwhelmed by thousands of daily alerts, many of which are false positives. The SOC manager wants to improve the signal-to-noise ratio without losing visibility into genuine threats. Which action should the SOC take first?
Select an answer first
5foundation · easy
What is the primary purpose of a Security Information and Event Management (SIEM) system in a SOC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.