A SOC team is overwhelmed by a high volume of low-severity alerts, causing analysts to miss critical incidents. Which tool would most directly help address this problem?

A ticketing system with more fields

A new SIEM with more storage capacity

A threat intelligence feed with more indicators

A SOAR platform to automate triage and enrichment of alerts

A SOC manager is reviewing the team's performance. The team has a high number of alerts closed as false positives, but the true-positive rate is low. The manager suspects that analysts are closing alerts too quickly without proper investigation. Which KPI would best reveal this problem?

Number of alerts escalated to tier 2

Mean time to close (MTTC) alerts

Number of SIEM queries run per analyst

A SOC analyst receives an alert for a suspicious login from an unfamiliar IP address. The analyst checks the SIEM, sees no other related activity, and closes the alert as a false positive. Later, the same IP is linked to a confirmed breach. Which process gap most directly contributed to this outcome?

The SIEM was not configured to ingest logs from the authentication server.

The analyst did not escalate the alert to a tier 2 handler before closing it.

The analyst should have used a SOAR playbook to automatically block the IP address.

The SOC lacked a documented triage procedure requiring additional context and correlation before closing alerts.

A company is building a SOC with a limited budget. They need to decide between investing in a SIEM, a SOAR, or additional analysts. The SOC currently has no automation and a small team. The primary goal is to improve detection and response speed while keeping costs manageable. Which approach best balances these constraints?

Invest in a SIEM first, then add analysts, and later a SOAR

Hire more analysts first, then invest in a SIEM and SOAR

Invest in a SOAR first to automate manual tasks, then add a SIEM

Implement a SIEM and SOAR together, and hire fewer analysts

A SOC manager wants to measure the effectiveness of the SOC's detection capabilities. Which metric would be most appropriate for this purpose?

Number of incidents escalated to tier 2

Percentage of alerts that are true positives

Number of SIEM queries run per day

GIAC Security Operations Certified

Domain 1Objective 3

SOC Management Systems GSOC Practice Questions (Page 9)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 41–45

41application · medium
A SOC team is overwhelmed by a high volume of low-severity alerts, causing analysts to miss critical incidents. Which tool would most directly help address this problem?
Select an answer first
42expert · hard
A SOC manager is reviewing the team's performance. The team has a high number of alerts closed as false positives, but the true-positive rate is low. The manager suspects that analysts are closing alerts too quickly without proper investigation. Which KPI would best reveal this problem?
Select an answer first
43application · medium
A SOC analyst receives an alert for a suspicious login from an unfamiliar IP address. The analyst checks the SIEM, sees no other related activity, and closes the alert as a false positive. Later, the same IP is linked to a confirmed breach. Which process gap most directly contributed to this outcome?
Select an answer first
44expert · hard
A company is building a SOC with a limited budget. They need to decide between investing in a SIEM, a SOAR, or additional analysts. The SOC currently has no automation and a small team. The primary goal is to improve detection and response speed while keeping costs manageable. Which approach best balances these constraints?
Select an answer first
45application · medium
A SOC manager wants to measure the effectiveness of the SOC's detection capabilities. Which metric would be most appropriate for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

SOC Management Systems GSOC Practice Questions (Page 9)

Questions 41–45

A SOC team is overwhelmed by a high volume of low-severity alerts, causing analysts to miss critical incidents. Which tool would most directly help address this problem?

A SOC manager is reviewing the team's performance. The team has a high number of alerts closed as false positives, but the true-positive rate is low. The manager suspects that analysts are closing alerts too quickly without proper investigation. Which KPI would best reveal this problem?

A SOC manager wants to measure the effectiveness of the SOC's detection capabilities. Which metric would be most appropriate for this purpose?

Keep studying — Security Operations Fundamentals