A SOC manager must choose between two SIEM solutions: Solution A has a lower upfront cost but requires significant manual tuning and has limited automation; Solution B has a higher upfront cost but includes automated alert triage and machine learning. The SOC has a small team and a high alert volume. Which solution is more appropriate?

Solution A, because manual tuning gives analysts more control.

Solution A, because the lower upfront cost fits the budget.

Solution B, because automation reduces the burden on the small team and improves efficiency.

Solution B, because it is more expensive and therefore better.

A SOC is at a maturity level where it has defined processes but they are not consistently followed. The manager wants to improve maturity by ensuring processes are followed and measured. Which initiative would be most effective?

Provide additional training on the SIEM's advanced features.

Increase the number of alerts monitored by the SIEM.

Replace the ticketing system with a more modern one.

Implement a quality assurance program that audits a sample of closed tickets for adherence to procedures.

What is the purpose of a SOC's escalation procedure?

To ensure that alerts are handled by the appropriate level of expertise based on severity

To automatically resolve all low-priority alerts without human review

To increase the volume of alerts processed by the SOC

To document every alert for compliance purposes

A SOC is implementing a new SIEM solution. The team needs to ensure that the SIEM can collect logs from various sources and correlate events to detect attacks. Which additional technology is most important to integrate with the SIEM to enhance its detection capability?

A password manager for the SOC team.

A vulnerability scanner that runs monthly.

Intrusion detection/prevention systems (IDS/IPS) feeding alerts into the SIEM.

A physical access control system for the SOC facility.

GIAC Security Leadership

Domain 3Objective 1

Managing a Security Operations Center GSLC Practice Questions (Page 2)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 6–10

6foundation · easy
In a typical SOC, which role is primarily responsible for triaging alerts and determining whether they are legitimate threats?
Select an answer first
7expert · hard
A SOC manager must choose between two SIEM solutions: Solution A has a lower upfront cost but requires significant manual tuning and has limited automation; Solution B has a higher upfront cost but includes automated alert triage and machine learning. The SOC has a small team and a high alert volume. Which solution is more appropriate?
Select an answer first
8expert · hard
A SOC is at a maturity level where it has defined processes but they are not consistently followed. The manager wants to improve maturity by ensuring processes are followed and measured. Which initiative would be most effective?
Select an answer first
9foundation · easy
What is the purpose of a SOC's escalation procedure?
Select an answer first
10application · medium
A SOC is implementing a new SIEM solution. The team needs to ensure that the SIEM can collect logs from various sources and correlate events to detect attacks. Which additional technology is most important to integrate with the SIEM to enhance its detection capability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Managing a Security Operations Center GSLC Practice Questions (Page 2)

Questions 6–10

In a typical SOC, which role is primarily responsible for triaging alerts and determining whether they are legitimate threats?

A SOC is at a maturity level where it has defined processes but they are not consistently followed. The manager wants to improve maturity by ensuring processes are followed and measured. Which initiative would be most effective?

What is the purpose of a SOC's escalation procedure?

A SOC is implementing a new SIEM solution. The team needs to ensure that the SIEM can collect logs from various sources and correlate events to detect attacks. Which additional technology is most important to integrate with the SIEM to enhance its detection capability?

Keep studying — Security Operations and Incident Management