Operational Improvement GSOC Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   After a significant security incident, the incident response team completes a hot wash. The team identifies that critical intelligence from the threat intelligence team was not shared until late in the response. Which action should the SOC manager take to incorporate this lesson learned?

   • APurchase a new threat intelligence platform to automate intelligence sharing.
   • BUpdate the incident response plan to include a mandatory intelligence brief at the start of every incident and schedule a joint review with the threat intelligence team.
   • CReprimand the threat intelligence team for the delay in sharing intelligence.
   • DDocument the lesson in the after-action report and archive it for future reference.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A SOC manager is reviewing quarterly metrics and notices that the number of incidents handled has increased by 50%, but the MTTR has also increased by 30%. The manager suspects that the increase in incidents is due to a new alert rule that generates many false positives. What is the most appropriate action?

   • ASet a higher severity threshold for the new alert rule.
   • BIncrease the SOC team size to handle the additional incidents.
   • CAnalyze the false positive rate of the new alert rule and tune it to reduce noise while maintaining detection of true positives.
   • DDisable the new alert rule entirely to reduce the incident count.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   After a major incident, the SOC team holds a lessons-learned meeting. Several analysts note that the escalation process was unclear, causing delays. The manager wants to ensure the next incident runs more smoothly. Which action best incorporates the feedback into operational improvement?

   • ASend a summary of the meeting to all stakeholders and archive it for future reference.
   • BDocument the lessons learned and update the incident response playbook with a clear escalation matrix.
   • CPurchase a new incident management tool to replace the current ticketing system.
   • DReprimand the analysts who failed to escalate in a timely manner.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A SOC manager wants to reduce the time analysts spend on low-priority alerts. After reviewing the metrics, the manager sees that the average time to triage is high, but the number of false positives is also high. The manager wants to use a continuous improvement approach to address this. Which initial action best aligns with the Plan phase of the PDCA cycle?

   • ADeploy an automated triage rule that immediately closes all alerts matching a known false-positive pattern.
   • BAnalyze the alert types and false-positive rates to identify the highest-impact areas for improvement.
   • CTrain all analysts on a new triage procedure that emphasizes speed over thoroughness.
   • DReplace the SIEM with a new platform that promises lower false-positive rates.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A SOC is evaluating a new SOAR platform that promises to automate 80% of alert triage. However, the implementation will require significant changes to existing workflows and a two-week migration period. The SOC manager is concerned about the impact on ongoing operations. What is the best approach to implement this upgrade while minimizing disruption?

   • AImplement the SOAR platform all at once to realize benefits quickly.
   • BDelay the implementation until the next major incident occurs.
   • COnly implement the SOAR platform for low-severity alerts and keep the rest manual.
   • DRun the SOAR platform in parallel with the existing SIEM for a trial period, then gradually migrate workflows based on success metrics.
   Reveal Solution Discussion Select an answer first