When designing a new security analytic, which of the following is the FIRST step according to analytic design principles?

Determining the alerting threshold that minimizes false positives

Defining the specific business or security objective the analytic will support

Writing the query or rule that will generate alerts

Selecting the data source with the richest available fields

A SOC runs an analytic that correlates VPN login events with HR data to detect 'terminated employee access'. The query joins a large VPN log table with a small HR table and takes too long to run. The team wants to improve performance while maintaining accuracy. Which optimization is most effective?

Remove the HR join and alert on any VPN login by a user who has not logged in for 30 days.

Pre-filter the VPN logs to only include successful logins and then join with the HR table.

Load the entire VPN log table into memory for faster processing.

Run the analytic only once per day instead of in real time.

A SOC runs a real-time analytic that correlates authentication events with threat intelligence feeds. The query is slow and consumes excessive SIEM resources, causing other analytics to lag. The team needs to maintain real-time detection but reduce resource usage. Which approach is most effective?

Remove the threat intelligence correlation and alert on all authentication events.

Run the analytic as a batch job every hour instead of in real time.

Increase the SIEM's allocated memory to improve query performance.

Cache the threat intelligence feed locally and update it every 15 minutes instead of querying it live for each event.

Which of the following is a technique to reduce false negatives in security analytics?

Adding more filters to exclude benign events

A SOC's analytic for 'credential dumping' relies on a single event ID from the Windows Security log. The team recently discovered that attackers are using a technique that does not generate that event ID. They must update the analytic to catch the technique without overwhelming the SIEM. Which approach best balances detection coverage and operational load?

Replace the current event ID with the new one to keep the analytic simple.

Create a separate analytic for the new technique and leave the original unchanged.

Use a broader analytic that looks for any process accessing the LSASS process, regardless of event ID.

Add a second event ID that is generated by the alternate technique and combine them with an OR condition.

GIAC Security Operations Certified

Domain 3Objective 2

Analytic Design and Tuning GSOC Practice Questions (Page 5)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 21–25

21foundation · easy
When designing a new security analytic, which of the following is the FIRST step according to analytic design principles?
Select an answer first
22expert · hard
A SOC runs an analytic that correlates VPN login events with HR data to detect 'terminated employee access'. The query joins a large VPN log table with a small HR table and takes too long to run. The team wants to improve performance while maintaining accuracy. Which optimization is most effective?
Select an answer first
23expert · hard
A SOC runs a real-time analytic that correlates authentication events with threat intelligence feeds. The query is slow and consumes excessive SIEM resources, causing other analytics to lag. The team needs to maintain real-time detection but reduce resource usage. Which approach is most effective?
Select an answer first
24foundation · easy
Which of the following is a technique to reduce false negatives in security analytics?
Select an answer first
25expert · hard
A SOC's analytic for 'credential dumping' relies on a single event ID from the Windows Security log. The team recently discovered that attackers are using a technique that does not generate that event ID. They must update the analytic to catch the technique without overwhelming the SIEM. Which approach best balances detection coverage and operational load?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.