A SOC manager is under pressure to reduce costs. The manager is considering reducing the number of Tier 1 analysts and relying more on automated alert triage. However, the SOC has a high rate of false positives, and the automation is not yet mature. What is the most prudent course of action?

Outsource the entire SOC to an MSSP to reduce costs.

Keep the current staffing levels while investing in tuning the automation to reduce false positives before considering staff reductions.

Reduce Tier 2 staff instead, since they are more expensive.

Immediately reduce Tier 1 staff and rely on automation to handle the workload.

A SOC team is overwhelmed by the volume of alerts from their SIEM. Many alerts are false positives. Which tool or process would directly reduce the false-positive burden?

Deploying a second SIEM for redundancy

Adding more analysts to review alerts

Increasing the log retention period

Tuning SIEM correlation rules and implementing alert whitelisting

What is the primary purpose of a Security Operations Center (SOC)?

To develop and enforce corporate security policies and standards

To conduct annual security awareness training for all employees

To continuously monitor, detect, analyze, and respond to security incidents across the organization's information systems

To design and implement new security architectures for the enterprise

Which metric is commonly used to measure the efficiency of a SOC's incident response process?

Number of security policies written

In a SOC's incident handling workflow, what is the typical first step after an alert is generated?

Containment of the affected systems

Triage and prioritization of the alert

Notification of senior management

GIAC Security Leadership

Domain 3Objective 1

Managing a Security Operations Center GSLC Practice Questions (Page 4)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 16–20

16expert · hard
A SOC manager is under pressure to reduce costs. The manager is considering reducing the number of Tier 1 analysts and relying more on automated alert triage. However, the SOC has a high rate of false positives, and the automation is not yet mature. What is the most prudent course of action?
Select an answer first
17application · medium
A SOC team is overwhelmed by the volume of alerts from their SIEM. Many alerts are false positives. Which tool or process would directly reduce the false-positive burden?
Select an answer first
18foundation · easy
What is the primary purpose of a Security Operations Center (SOC)?
Select an answer first
19foundation · easy
Which metric is commonly used to measure the efficiency of a SOC's incident response process?
Select an answer first
20foundation · easy
In a SOC's incident handling workflow, what is the typical first step after an alert is generated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.