Managing a Security Operations Center GSLC Practice Questions (Page 10)

Questions 46–46

1. 46application · medium

   A SOC manager notices that Tier 1 analysts are spending excessive time on low-severity alerts that could be automated, while Tier 2 analysts are frequently pulled away from deep investigations to handle escalations that should have been resolved at Tier 1. The manager wants to improve efficiency without adding staff. Which approach best addresses the workflow imbalance?

   • ADisable all low-severity alert rules in the SIEM to reduce noise.
   • BIncrease the number of Tier 2 analysts by reassigning Tier 1 staff to Tier 2 roles.
   • CRequire all alerts to be escalated to Tier 2 for final disposition to ensure quality.
   • DImplement a runbook automation playbook for common low-severity alerts and enforce a strict escalation checklist for Tier 1 analysts.
   Reveal Solution Discussion Select an answer first