A SOC is experiencing a high number of false positives from a specific detection rule. Analysts are spending too much time investigating these alerts, leading to fatigue and potential missed incidents. The SOC manager wants to reduce the false-positive rate without losing detection of real threats. Which approach best balances these competing goals?

Create a separate ticket for every alert to ensure nothing is missed.

Increase the severity of the rule so analysts prioritize it more.

Tune the detection rule by adjusting thresholds and adding context filters.

Disable the detection rule entirely to eliminate false positives.

A SOC manager wants to demonstrate the value of the SOC to executive leadership. Which KPI would best communicate the SOC's effectiveness in reducing the impact of incidents?

Mean time to contain (MTTC) incidents

Number of SIEM integrations deployed

Number of security alerts processed per day

Percentage of analysts with security certifications

A SOC analyst receives an alert for a potential data exfiltration. The analyst checks the SIEM and sees a large outbound transfer to an external IP. The analyst immediately blocks the IP and closes the alert. Later, it is discovered that the transfer was a legitimate backup. What process failure is most evident?

The SIEM generated a false positive

The ticketing system did not require a justification for closure

The analyst should have escalated to the incident response team

The analyst did not follow the incident response playbook

A SOC manager is evaluating the SOC's overall effectiveness. The SOC has a high number of alerts, but a low number of confirmed incidents. The team is spending most of its time on false positives. Which change would most improve the SOC's effectiveness?

Increase the number of analysts

Shorten the alert retention period

Add more threat intelligence feeds

Refine the SIEM correlation rules to reduce false positives

GIAC Security Operations Certified

Domain 1Objective 3

SOC Management Systems GSOC Practice Questions (Page 8)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 36–40

36expert · hard
A SOC is experiencing a high number of false positives from a specific detection rule. Analysts are spending too much time investigating these alerts, leading to fatigue and potential missed incidents. The SOC manager wants to reduce the false-positive rate without losing detection of real threats. Which approach best balances these competing goals?
Select an answer first
37application · medium
A SOC manager wants to demonstrate the value of the SOC to executive leadership. Which KPI would best communicate the SOC's effectiveness in reducing the impact of incidents?
Select an answer first
38application · medium
A SOC has well-defined processes, documented procedures, and regular reporting, but lacks formal governance and executive oversight. According to a maturity model, which level is most likely?
Select an answer first
39expert · hard
A SOC analyst receives an alert for a potential data exfiltration. The analyst checks the SIEM and sees a large outbound transfer to an external IP. The analyst immediately blocks the IP and closes the alert. Later, it is discovered that the transfer was a legitimate backup. What process failure is most evident?
Select an answer first
40expert · hard
A SOC manager is evaluating the SOC's overall effectiveness. The SOC has a high number of alerts, but a low number of confirmed incidents. The team is spending most of its time on false positives. Which change would most improve the SOC's effectiveness?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

SOC Management Systems GSOC Practice Questions (Page 8)

Questions 36–40

A SOC manager wants to demonstrate the value of the SOC to executive leadership. Which KPI would best communicate the SOC's effectiveness in reducing the impact of incidents?

A SOC has well-defined processes, documented procedures, and regular reporting, but lacks formal governance and executive oversight. According to a maturity model, which level is most likely?

A SOC manager is evaluating the SOC's overall effectiveness. The SOC has a high number of alerts, but a low number of confirmed incidents. The team is spending most of its time on false positives. Which change would most improve the SOC's effectiveness?

Keep studying — Security Operations Fundamentals