A SOC manager is leading a maturity assessment. The SOC has a SIEM, documented processes, and a ticketing system, but analysts frequently bypass the ticketing system during high-pressure incidents, and post-incident reviews are rarely conducted. According to a typical SOC maturity model, which capability is the weakest?

Threat intelligence integration

Process adherence and continuous improvement

A SOC has been operating for a year with ad-hoc processes and inconsistent documentation. The manager wants to formalize operations and improve maturity. Which initiative should be the first priority?

Increase the number of SOC analysts.

Conduct a penetration test to identify vulnerabilities.

Document standard operating procedures (SOPs) for alert triage, escalation, and incident response.

Purchase a new SIEM platform with advanced analytics.

What does the 'false positive rate' metric indicate about a SOC's performance?

The number of incidents that were successfully contained

The average time to escalate an alert to a higher tier

The percentage of alerts that are investigated and found not to be real threats

The total number of security tools deployed in the SOC

A SOC analyst receives an alert for a potential malware infection on a user's workstation. The analyst has verified the alert and confirmed it is a true positive. According to the SOC's escalation policy, the next step is to escalate to the incident response team. Which action should the analyst take?

Delete the alert from the SIEM to reduce noise.

Create a ticket in the ticketing system with all relevant details and escalate it to the incident response team.

Immediately disconnect the workstation from the network without notifying anyone.

Wait for the user to report the issue before taking any action.

A company is establishing a SOC to improve its security posture. The SOC's primary purpose is to monitor and defend the organization's information systems. Which capability is most essential for the SOC to fulfill this purpose?

A large team of penetration testers to proactively find vulnerabilities.

Regular security awareness training for all employees.

Continuous monitoring of security events across the organization's networks and systems.

A comprehensive set of security policies and procedures.

GIAC Security Leadership

Domain 3Objective 1

Managing a Security Operations Center GSLC Practice Questions (Page 5)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 21–25

21expert · hard
A SOC manager is leading a maturity assessment. The SOC has a SIEM, documented processes, and a ticketing system, but analysts frequently bypass the ticketing system during high-pressure incidents, and post-incident reviews are rarely conducted. According to a typical SOC maturity model, which capability is the weakest?
Select an answer first
22application · medium
A SOC has been operating for a year with ad-hoc processes and inconsistent documentation. The manager wants to formalize operations and improve maturity. Which initiative should be the first priority?
Select an answer first
23foundation · easy
What does the 'false positive rate' metric indicate about a SOC's performance?
Select an answer first
24application · medium
A SOC analyst receives an alert for a potential malware infection on a user's workstation. The analyst has verified the alert and confirmed it is a true positive. According to the SOC's escalation policy, the next step is to escalate to the incident response team. Which action should the analyst take?
Select an answer first
25application · medium
A company is establishing a SOC to improve its security posture. The SOC's primary purpose is to monitor and defend the organization's information systems. Which capability is most essential for the SOC to fulfill this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Managing a Security Operations Center GSLC Practice Questions (Page 5)

Questions 21–25

A SOC has been operating for a year with ad-hoc processes and inconsistent documentation. The manager wants to formalize operations and improve maturity. Which initiative should be the first priority?

What does the 'false positive rate' metric indicate about a SOC's performance?

A company is establishing a SOC to improve its security posture. The SOC's primary purpose is to monitor and defend the organization's information systems. Which capability is most essential for the SOC to fulfill this purpose?

Keep studying — Security Operations and Incident Management