When selecting a data source for a security analytic, which of the following is the MOST important criterion?

The data source contains the fields and events needed to detect the target behavior

The data source is the cheapest to store

The data source is the easiest to query

The data source is the one most commonly used by other organizations

A SOC team has tuned an analytic to reduce false positives, but after a month, the alert volume has increased again because the IT team adopted a new administrative tool that triggers the same pattern. What is the most effective continuous improvement step?

Review the analytic's performance metrics and update the allowlist or filters to account for the new tool.

Disable the analytic until the IT team stops using the new tool.

Increase the alert severity so the new alerts are prioritized for review.

Revert the analytic to its original state because the tuning was ineffective.

Which technique is specifically used to reduce false positives in a security analytic?

Adding more data sources to the analytic

A SOC has an analytic that detects 'pass-the-hash' activity. After a major Windows update, the analytic starts generating many false positives because the update changes how certain authentication events are logged. The SOC needs to address this quickly while maintaining detection capability. What is the best course of action?

Temporarily adjust the analytic's filters to exclude the new event patterns, document the change, and schedule a review after the update is fully deployed.

Increase the alert threshold to reduce the number of alerts, even if it means missing some real attacks.

Disable the analytic until the next Windows update is released.

Revert the Windows update on all systems to restore the original logging behavior.

Why is it important to minimize false negatives in security analytics?

To ensure critical threats are not missed

To reduce the workload on analysts

To comply with data retention policies

GIAC Security Operations Certified

Domain 3Objective 2

Analytic Design and Tuning GSOC Practice Questions (Page 10)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 46–50

46foundation · easy
When selecting a data source for a security analytic, which of the following is the MOST important criterion?
Select an answer first
47application · medium
A SOC team has tuned an analytic to reduce false positives, but after a month, the alert volume has increased again because the IT team adopted a new administrative tool that triggers the same pattern. What is the most effective continuous improvement step?
Select an answer first
48foundation · easy
Which technique is specifically used to reduce false positives in a security analytic?
Select an answer first
49expert · hard
A SOC has an analytic that detects 'pass-the-hash' activity. After a major Windows update, the analytic starts generating many false positives because the update changes how certain authentication events are logged. The SOC needs to address this quickly while maintaining detection capability. What is the best course of action?
Select an answer first
50foundation · easy
Why is it important to minimize false negatives in security analytics?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.