Operational Improvement GSOC Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC is planning to upgrade its SIEM to a cloud-based solution. The migration will require changes to data ingestion, alert rules, and analyst workflows. The SOC manager is concerned about the impact on the team's productivity during the transition. What is the most effective change management strategy?

   • AMigrate all data and workflows in a single weekend to minimize downtime.
   • BLet each analyst decide when to start using the new SIEM.
   • CDevelop a detailed migration plan with a pilot phase, training, and a rollback plan, and communicate it to the team.
   • DKeep the legacy SIEM running indefinitely to avoid disruption.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC receives thousands of low-severity alerts daily. Analysts manually check each alert against a threat intelligence feed and then decide whether to escalate. The SOC manager wants to reduce the time spent on this task. Which automation approach would be most effective?

   • AIncrease the number of analysts on the SOC team.
   • BDisable all low-severity alerts to reduce noise.
   • CCreate an automated workflow that enriches each alert with threat intelligence and applies a scoring model to prioritize alerts for analyst review.
   • DAsk analysts to work faster by setting a time limit for each alert.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A SOC's incident response process requires multiple approvals before an alert can be escalated to the incident response team. This has caused delays in critical incidents. The SOC manager wants to streamline the process without losing necessary oversight. Which approach best balances speed and control?

   • ARequire the same number of approvals but make them electronic.
   • BIncrease the number of approvers to ensure thorough review.
   • CRemove all approval steps to speed up the process.
   • DImplement an automated escalation workflow that triggers based on alert severity and requires a single approval for high-severity incidents.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A SOC is experiencing communication breakdowns during incidents because the incident commander uses a different communication tool than the rest of the team. This has led to missed updates and delayed responses. The SOC manager wants to improve communication without disrupting the incident commander's workflow. What is the best approach?

   • AStandardize on a single communication platform for all incident responders and provide training to the incident commander.
   • BAllow the incident commander to continue using their preferred tool and have a liaison relay updates.
   • CSend a daily email summary of incident updates to all team members.
   • DRequire the incident commander to use the team's tool only during major incidents.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A SOC team conducts a post-incident review after a data breach. The review reveals that the detection rule for the attack was not updated after a similar incident six months ago. The manager wants to ensure this lesson is incorporated into operations. Which action is most effective?

   • ASchedule a follow-up meeting in three months to review whether the rule has been updated.
   • BDocument the lesson learned in the post-incident report and share it with the team.
   • CBlame the analyst who was responsible for updating the rule and require additional training.
   • DUpdate the detection rule and add a verification step to the incident response playbook to check for similar gaps.
   Reveal Solution Discussion Select an answer first