After a major incident, the SOC team holds a lessons-learned meeting. One finding is that the on-call analyst did not have access to the necessary threat intelligence platform credentials. What should the SOC manager do to ensure this does not happen again?

Update the access control policy to ensure on-call analysts have the required credentials and verify access during shift handover.

Ask the on-call analyst to keep a personal copy of the credentials.

Document the issue in the incident report and move on.

Provide the on-call analyst with a temporary credential for the next incident.

A SOC analyst notices that many incident tickets are stuck in the 'pending analyst review' status because they require data from multiple tools. The manager wants to streamline the workflow. Which process optimization technique would most directly reduce the bottleneck?

Change the ticket status to 'resolved' when data is missing.

Create a new ticket type for each tool that needs to be checked.

Increase the number of analysts assigned to each ticket.

Integrate the tools so that relevant data is automatically aggregated into the ticket.

A SOC is considering upgrading its SIEM platform to a newer version that includes automated alert correlation. The current SIEM requires analysts to manually correlate events across multiple dashboards. The upgrade will require a migration of historical data and a brief downtime. What is the most important consideration before implementing the upgrade?

Assess the impact of the downtime on incident response coverage and plan a migration window during low activity.

Ensure the new SIEM has a more user-friendly interface.

Verify that the new SIEM supports the same log formats as the old one.

Train all analysts on the new SIEM before the upgrade.

A SOC has a high rate of false positives in phishing alerts. Analysts often spend time investigating benign emails. The SOC manager wants to improve analyst skills and reduce false positives. Which training initiative is most effective?

Increase the number of phishing alerts each analyst handles per shift.

Replace the phishing alert rule with a stricter rule that generates fewer alerts.

Provide advanced training on email header analysis and phishing detection techniques, followed by a review of recent false positives.

Require analysts to complete a general cybersecurity certification course.

A SOC manager wants to measure the effectiveness of the incident response team. The team has been handling a mix of low-severity and high-severity incidents. The manager is considering several KPIs. Which KPI would provide the most meaningful insight into the team's effectiveness?

Total number of incidents handled per month.

Percentage of incidents closed within 24 hours.

Number of alerts escalated to the incident response team.

Mean time to contain (MTTC) for high-severity incidents, segmented by incident type.

GIAC Security Operations Certified

Domain 3Objective 3

Operational Improvement GSOC Practice Questions (Page 6)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

Questions 26–30

26application · medium
After a major incident, the SOC team holds a lessons-learned meeting. One finding is that the on-call analyst did not have access to the necessary threat intelligence platform credentials. What should the SOC manager do to ensure this does not happen again?
Select an answer first
27application · medium
A SOC analyst notices that many incident tickets are stuck in the 'pending analyst review' status because they require data from multiple tools. The manager wants to streamline the workflow. Which process optimization technique would most directly reduce the bottleneck?
Select an answer first
28application · medium
A SOC is considering upgrading its SIEM platform to a newer version that includes automated alert correlation. The current SIEM requires analysts to manually correlate events across multiple dashboards. The upgrade will require a migration of historical data and a brief downtime. What is the most important consideration before implementing the upgrade?
Select an answer first
29application · medium
A SOC has a high rate of false positives in phishing alerts. Analysts often spend time investigating benign emails. The SOC manager wants to improve analyst skills and reduce false positives. Which training initiative is most effective?
Select an answer first
30expert · hard
A SOC manager wants to measure the effectiveness of the incident response team. The team has been handling a mix of low-severity and high-severity incidents. The manager is considering several KPIs. Which KPI would provide the most meaningful insight into the team's effectiveness?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.