Operational Improvement GSOC Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During a ransomware incident, the SOC discovers that the legal department was not informed until after the ransom demand was received. The incident response plan did not specify when legal should be notified. What should the SOC manager do to improve communication for future incidents?

   • ASend a memo to all staff reminding them to include legal in incidents.
   • BWait for the next incident to see if the problem recurs.
   • CBlame the incident commander for not notifying legal.
   • DUpdate the incident response plan to include legal notification triggers and add legal to the incident communication tree.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC has implemented a new alert triage process. After two months, the manager reviews the KPIs and finds that the mean time to respond (MTTR) has not improved. According to the PDCA cycle, what should the manager do next?

   • AIncrease the MTTR target to make the current performance look acceptable.
   • BCheck the process data to identify why the expected improvement did not occur, then adjust the process accordingly.
   • CContinue the process unchanged for another six months to give it more time.
   • DAbandon the new process and return to the old one immediately.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is a key benefit of establishing clear communication channels within a SOC?

   • AIt guarantees that all incidents are resolved without errors
   • BIt eliminates the need for escalation procedures
   • CIt ensures that critical information is shared quickly and accurately during incidents
   • DIt reduces the need for documentation
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A SOC's incident response workflow requires multiple approvals before a containment action can be executed. This has caused delays during fast-moving incidents. The manager wants to streamline the process without losing necessary oversight. Which optimization technique best addresses this trade-off?

   • AIncrease the number of approvers to ensure more oversight.
   • BRemove all approval requirements for containment actions.
   • CRequire a single senior analyst to approve all containment actions.
   • DDefine a pre-approved containment playbook for specific incident types, with post-incident review by management.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A SOC manager is defining the goals of an operational improvement project. The team is overwhelmed by the number of alerts and is experiencing analyst burnout. The manager wants to set a realistic goal that addresses the root cause. Which goal is most appropriate?

   • ASet a goal to reduce analyst burnout by 50% without specifying how.
   • BIncrease the alert volume to ensure no true positives are missed.
   • CReduce alert volume by 25% by tuning detection rules to eliminate known false positives.
   • DHire more analysts to handle the alert volume.
   Reveal Solution Discussion Select an answer first