Continuous Improvement GSOM Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security operations team implemented a new process to reduce the number of unhandled alerts at the end of each shift. After one month, the manager reviews the data and sees that the number of unhandled alerts has decreased, but the number of alerts closed without thorough investigation has increased. What should the manager conclude about the improvement?

   • AThe improvement is successful because the primary metric improved.
   • BThe improvement may have introduced a new problem, and the manager should investigate the quality of alert closures.
   • CThe increase in closures without investigation is unrelated to the new process.
   • DThe team should stop using the new process because it is causing problems.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which statement best describes the role of continuous improvement in a security operations center (SOC)?

   • AIt is a one-time project conducted after a major security breach
   • BIt focuses exclusively on reducing the cost of security tools
   • CIt is primarily a documentation requirement for compliance audits
   • DIt is an ongoing cycle of assessing, adjusting, and enhancing SOC operations
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC manager is planning to reduce the average time to detect (MTTD) for critical alerts. The team has limited staffing and cannot afford new tooling. Which improvement plan is most realistic and measurable?

   • AImplement a new alert triage workflow that prioritizes critical alerts, and track MTTD weekly for the next two months to evaluate the impact.
   • BPurchase a new SIEM platform with automated correlation rules, assuming it will reduce MTTD immediately.
   • CIncrease the number of analysts on night shifts by reassigning day staff, and expect MTTD to drop within a week.
   • DCreate a new KPI for MTTD and report it in the monthly dashboard, without changing any processes.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security operations team has been experiencing recurring delays in escalating incidents to the next tier. The manager suspects the delays are caused by multiple factors, including unclear escalation criteria, insufficient staffing, and a cumbersome ticketing system. The manager wants to identify which factor contributes most to the delays before allocating resources. Which technique is best suited for this analysis?

   • AA survey of analysts asking which factor they think is most important.
   • BA control chart to monitor the escalation delay over time.
   • CPareto analysis to identify the most frequent or impactful cause among the suspected factors.
   • DA brainstorming session to list all possible causes without ranking them.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which continuous improvement model is structured around the phases of Plan, Do, Check, and Act?

   • AITIL
   • BKaizen
   • CDMAIC
   • DPDCA
   Reveal Solution Discussion Select an answer first