A SOC analyst receives an alert for a potential malware infection on a critical server. The analyst has verified the alert is a true positive. According to standard SOC workflow, what should the analyst do next?

Escalate the incident to the incident response team and open a ticket.

Close the alert and move on to the next one.

Wait for additional alerts before taking action.

Reboot the server to clear the infection.

A SOC uses a SIEM with a ticketing system. The team is experiencing a backlog of unprocessed alerts because the ticketing system is not automatically creating tickets for all SIEM alerts. The manager wants to ensure that every alert is tracked and worked. Which action would be most effective?

Have analysts manually create tickets for every alert they see.

Integrate the SIEM with the ticketing system so that every alert automatically generates a ticket.

Increase the number of analysts to handle the backlog.

Disable alerts that are not automatically ticketed to reduce the backlog.

A SOC is in the 'defined' stage of maturity, with documented processes but inconsistent execution. The manager wants to advance to the 'managed' stage. Which initiative is most aligned with this goal?

Hire a consultant to review the SOC's architecture.

Purchase additional security tools to enhance detection.

Create more detailed documentation for every process.

Establish quantitative process metrics and use them to manage and improve performance.

A SOC manager is reviewing the team's workflow after a series of low-severity alerts were escalated directly to the incident response team, causing alert fatigue and delayed responses to genuine incidents. The SOC has three tiers of analysts and a documented escalation policy. Which change would most directly address the root cause of the problem?

Increase the number of Tier 3 incident responders to handle the higher volume of escalated alerts.

Disable alerts for all low-severity signatures in the SIEM to reduce noise.

Require Tier 1 analysts to validate and enrich all alerts before escalating to Tier 2, following the documented triage procedure.

Have Tier 3 analysts review every alert before it is entered into the ticketing system.

An organization's SOC is being criticized for not detecting a breach that occurred three weeks ago. The breach was only discovered by an external party. Which SOC function was most deficient?

Continuous monitoring and detection

GIAC Security Leadership

Domain 3Objective 1

Managing a Security Operations Center GSLC Practice Questions (Page 9)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 41–45

41application · medium
A SOC analyst receives an alert for a potential malware infection on a critical server. The analyst has verified the alert is a true positive. According to standard SOC workflow, what should the analyst do next?
Select an answer first
42expert · hard
A SOC uses a SIEM with a ticketing system. The team is experiencing a backlog of unprocessed alerts because the ticketing system is not automatically creating tickets for all SIEM alerts. The manager wants to ensure that every alert is tracked and worked. Which action would be most effective?
Select an answer first
43expert · hard
A SOC is in the 'defined' stage of maturity, with documented processes but inconsistent execution. The manager wants to advance to the 'managed' stage. Which initiative is most aligned with this goal?
Select an answer first
44application · medium
A SOC manager is reviewing the team's workflow after a series of low-severity alerts were escalated directly to the incident response team, causing alert fatigue and delayed responses to genuine incidents. The SOC has three tiers of analysts and a documented escalation policy. Which change would most directly address the root cause of the problem?
Select an answer first
45application · medium
An organization's SOC is being criticized for not detecting a breach that occurred three weeks ago. The breach was only discovered by an external party. Which SOC function was most deficient?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.