A SOC is evaluating a new endpoint detection and response (EDR) tool. The current tool has a high false-positive rate, and analysts spend too much time investigating. The SOC manager wants to justify the upgrade to management. Which evidence would most strongly support the upgrade?

An analyst's personal preference for the new tool's interface.

A statement that the current tool is outdated and must be replaced.

A vendor brochure claiming the new EDR is the best on the market.

A comparison showing the new EDR reduces false positives by 40% based on a proof-of-concept in the SOC environment.

What is the primary goal of operational improvement in a security operations center (SOC)?

To increase the number of security tools deployed

To replace all manual analysis with automated systems

To reduce the SOC's operating budget to the minimum possible

To enhance the effectiveness and efficiency of SOC processes and outcomes

GIAC Security Operations Certified

Domain 3Objective 3

Operational Improvement GSOC Practice Questions (Page 12)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

Questions 56–58

56application · medium
A SOC is evaluating a new endpoint detection and response (EDR) tool. The current tool has a high false-positive rate, and analysts spend too much time investigating. The SOC manager wants to justify the upgrade to management. Which evidence would most strongly support the upgrade?
Select an answer first
57foundation · easy
What is the primary goal of operational improvement in a security operations center (SOC)?
Select an answer first
58foundation · easy
Which technique is commonly used to streamline an incident response workflow by identifying and eliminating non-value-added steps?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

Operational Improvement GSOC Practice Questions (Page 12)

Questions 56–58

A SOC is evaluating a new endpoint detection and response (EDR) tool. The current tool has a high false-positive rate, and analysts spend too much time investigating. The SOC manager wants to justify the upgrade to management. Which evidence would most strongly support the upgrade?

What is the primary goal of operational improvement in a security operations center (SOC)?

Which technique is commonly used to streamline an incident response workflow by identifying and eliminating non-value-added steps?

Keep studying — Incident Response and Optimization