Which step is typically part of a change management process?

Keeping the change undocumented to avoid scrutiny

Rejecting all changes to the SOC environment

Submitting a change request for review and approval

Implementing the change immediately after it is proposed

What is the goal of standardizing incident response procedures?

To eliminate the need for analyst judgment

To ensure every incident is handled in exactly the same way regardless of circumstances

To increase the complexity of the response process

To reduce variability and improve consistency in response actions

After a ransomware incident, the SOC team identifies that communication with the IT department was fragmented, leading to delays in isolating affected systems. The SOC manager wants to improve inter-departmental collaboration for future incidents. Which action is most likely to achieve this?

Hold a monthly meeting between SOC and IT to discuss general security topics.

Establish a joint incident response plan with IT that defines roles, communication channels, and decision-making authority.

Create a shared chat group for the SOC and IT teams and use it during incidents.

Ask IT to follow the SOC's existing incident response plan without modification.

A SOC team spends significant time manually enriching IP addresses and domains for every alert. The manager wants to reduce this repetitive effort while maintaining analyst oversight. Which approach best balances automation with human review?

Replace the SIEM with a new platform that has built-in enrichment.

Require analysts to manually enrich every alert to ensure accuracy.

Configure the SIEM to automatically close any alert containing an indicator that is not on a blocklist.

Create a playbook that automatically enriches indicators and adds the results to the alert, leaving the final disposition to the analyst.

A SOC handles a high volume of low-severity alerts that require the same initial triage steps. Analysts spend 30% of their time on these repetitive tasks. The SOC manager wants to free up analyst time for more complex investigations. Which action is most effective?

Create an automation playbook that performs the initial triage and enriches the alert with context before assigning it to an analyst.

Hire more analysts to handle the volume of alerts.

Increase the severity threshold so fewer alerts are generated.

Ask analysts to work overtime to clear the alert queue.

GIAC Security Operations Certified

Domain 3Objective 3

Operational Improvement GSOC Practice Questions (Page 4)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

Questions 16–20

16foundation · easy
Which step is typically part of a change management process?
Select an answer first
17foundation · easy
What is the goal of standardizing incident response procedures?
Select an answer first
18expert · hard
After a ransomware incident, the SOC team identifies that communication with the IT department was fragmented, leading to delays in isolating affected systems. The SOC manager wants to improve inter-departmental collaboration for future incidents. Which action is most likely to achieve this?
Select an answer first
19application · medium
A SOC team spends significant time manually enriching IP addresses and domains for every alert. The manager wants to reduce this repetitive effort while maintaining analyst oversight. Which approach best balances automation with human review?
Select an answer first
20application · medium
A SOC handles a high volume of low-severity alerts that require the same initial triage steps. Analysts spend 30% of their time on these repetitive tasks. The SOC manager wants to free up analyst time for more complex investigations. Which action is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.