Which practice is an example of continuous improvement for a SOC?

Increasing the number of alerts monitored without adjusting processes

Keeping the same procedures for years to ensure stability

Reducing the number of SOC analysts to cut costs

Conducting regular post-incident reviews to identify lessons learned

A SOC manager wants to evaluate the efficiency of the incident response process. Which KPI is most appropriate for this purpose?

Percentage of analysts with certifications

Number of security tools deployed

A SOC manager wants to improve the team's efficiency by reducing the time spent on false positives. The manager is considering implementing a new metric to track this. Which metric would be most appropriate?

Number of firewall rule changes per month

Number of security incidents reported by users

Average time to patch vulnerabilities

False positive rate (percentage of alerts that are not genuine threats)

A SOC uses a SIEM for log aggregation and alerting, but analysts struggle to manage the high volume of alerts and lack a structured way to track investigations. Which additional technology would most directly address this gap?

An endpoint detection and response (EDR) tool

A ticketing system integrated with the SIEM

A network packet capture appliance

A SOC manager wants to advance the SOC from a 'reactive' to a 'proactive' maturity stage. The SOC currently responds to alerts but does not actively hunt for threats. Which initiative is most aligned with this goal?

Increasing the frequency of alert reviews from daily to hourly.

Adding more SIEM correlation rules.

Implementing a threat hunting program that uses threat intelligence to proactively search for indicators of compromise.

Reducing the number of false positives by tuning rules.

GIAC Security Leadership

Domain 3Objective 1

Managing a Security Operations Center GSLC Practice Questions (Page 6)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 26–30

26foundation · easy
Which practice is an example of continuous improvement for a SOC?
Select an answer first
27application · medium
A SOC manager wants to evaluate the efficiency of the incident response process. Which KPI is most appropriate for this purpose?
Select an answer first
28application · medium
A SOC manager wants to improve the team's efficiency by reducing the time spent on false positives. The manager is considering implementing a new metric to track this. Which metric would be most appropriate?
Select an answer first
29application · medium
A SOC uses a SIEM for log aggregation and alerting, but analysts struggle to manage the high volume of alerts and lack a structured way to track investigations. Which additional technology would most directly address this gap?
Select an answer first
30expert · hard
A SOC manager wants to advance the SOC from a 'reactive' to a 'proactive' maturity stage. The SOC currently responds to alerts but does not actively hunt for threats. Which initiative is most aligned with this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.