Operational Improvement GSOC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of using Key Performance Indicators (KPIs) in a SOC?

   • ATo provide a quantitative basis for evaluating and improving SOC performance
   • BTo replace the need for detailed incident reports
   • CTo satisfy regulatory compliance requirements exclusively
   • DTo automate the incident response process
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC supervisor notices that junior analysts are struggling to identify advanced persistent threat (APT) activity. The team's KPIs show an increase in missed detections. The supervisor wants to implement a training program to close this skill gap. Which training approach is most likely to improve the team's detection capability?

   • AProvide hands-on training using real-world APT scenarios and conduct a post-training assessment to measure improvement.
   • BRequire all analysts to complete a generic cybersecurity awareness course.
   • CIncrease the number of alerts each analyst must handle to force faster learning.
   • DAssign each junior analyst a mentor and hope that skills improve over time.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC plans to replace its legacy endpoint detection and response (EDR) tool with a new one. The new tool requires agents to be installed on all endpoints, which will cause a brief performance impact. The SOC manager wants to minimize disruption to business operations. Which change management approach is most appropriate?

   • ARoll out the new EDR in phases, starting with a pilot group and monitoring performance before full deployment.
   • BAsk business units to approve the performance impact before deployment.
   • CDeploy the new EDR to all endpoints at once to complete the migration quickly.
   • DUninstall the legacy EDR before installing the new one on all endpoints.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of change management in a SOC?

   • ATo ensure that changes are made in a controlled and coordinated manner to minimize disruption
   • BTo implement changes as quickly as possible without review
   • CTo document changes only after they have been implemented
   • DTo prevent any changes from being made to the SOC environment
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC handles a high volume of phishing alerts. Analysts manually check each URL against a threat intelligence feed and then block it if malicious. The manager wants to automate this process but is concerned about the risk of blocking legitimate URLs. Which automation strategy best balances efficiency and safety?

   • AAutomate the URL check and block all URLs that are not on an allowlist.
   • BDo not automate any part of the process because the risk of blocking legitimate URLs is too high.
   • CAutomate the URL reputation check and automatically block URLs that are on a high-confidence blocklist, while sending low-confidence results to analysts for review.
   • DAutomate the URL check but require manual approval for every block.
   Reveal Solution Discussion Select an answer first