A SOC is considering upgrading its SIEM to a cloud-based solution. The team is concerned about data residency requirements and the potential for increased latency. The current on-premises SIEM is reaching capacity. Which evaluation approach best addresses these concerns?

Select the cloud SIEM based on vendor marketing materials that promise low latency and compliance.

Keep the on-premises SIEM and add more storage to extend its life.

Conduct a proof-of-concept in the target cloud region, testing latency and verifying data residency compliance.

Assume that any cloud provider meets data residency requirements because they offer multiple regions.

A SOC uses a ticketing system to manage incident reports. Analysts often need to request additional information from the system owner, which causes delays. The manager wants to automate this communication. Which automation approach is most appropriate?

Require analysts to call the system owner for every ticket.

Remove the need for additional information by assuming the system owner has no relevant data.

Automatically close tickets if the system owner does not respond within 24 hours.

Create an automated email template that is sent to the system owner when a ticket is assigned, requesting the needed information.

A SOC manager notices that the average time to detect (MTTD) has remained flat for three months, but the average time to respond (MTTR) has increased by 40%. The team manually performs repetitive enrichment steps for every alert. The manager wants to reduce MTTR without adding staff. Which approach best addresses the root cause?

Change the MTTD metric to exclude alerts that require manual enrichment.

Provide additional training on how to use the existing SIEM search queries.

Implement an orchestration playbook that automatically enriches alerts with threat intelligence and opens a ticket with pre-populated context.

Increase the frequency of SOC team meetings to review each incident in detail.

What is the primary purpose of conducting a lessons-learned review after a major incident?

To document what happened and identify areas for improvement in future responses

To close the incident ticket as quickly as possible

To create a public report for external stakeholders

To assign blame to the analysts who made mistakes

During a security incident, the SOC needs to share critical information with the executive team and the legal department. The SOC manager wants to improve communication and collaboration. Which practice best supports effective information sharing during an incident?

Establish predefined communication templates and roles for incident updates to ensure consistent and timely information flow.

Share all technical details with every stakeholder to ensure transparency.

Use only email for all incident communication to keep a written record.

Wait until the incident is fully resolved before informing executives and legal.

GIAC Security Operations Certified

Domain 3Objective 3

Operational Improvement GSOC Practice Questions (Page 11)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

Questions 51–55

51expert · hard
A SOC is considering upgrading its SIEM to a cloud-based solution. The team is concerned about data residency requirements and the potential for increased latency. The current on-premises SIEM is reaching capacity. Which evaluation approach best addresses these concerns?
Select an answer first
52application · medium
A SOC uses a ticketing system to manage incident reports. Analysts often need to request additional information from the system owner, which causes delays. The manager wants to automate this communication. Which automation approach is most appropriate?
Select an answer first
53application · medium
A SOC manager notices that the average time to detect (MTTD) has remained flat for three months, but the average time to respond (MTTR) has increased by 40%. The team manually performs repetitive enrichment steps for every alert. The manager wants to reduce MTTR without adding staff. Which approach best addresses the root cause?
Select an answer first
54foundation · easy
What is the primary purpose of conducting a lessons-learned review after a major incident?
Select an answer first
55application · medium
During a security incident, the SOC needs to share critical information with the executive team and the legal department. The SOC manager wants to improve communication and collaboration. Which practice best supports effective information sharing during an incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.