Continuous Improvement GSOM Practice Questions (Page 10)

Questions 46–50

1. 46application · easy

   A security operations manager wants to improve the accuracy of threat intelligence used by the SOC. The team has collected baseline data, and the manager plans to use a structured approach that involves defining the problem, measuring current performance, analyzing causes, improving the process, and controlling the new state. Which continuous improvement model is the manager applying?

   • ADMAIC (Define, Measure, Analyze, Improve, Control)
   • BKaizen (continuous small improvements)
   • CSix Sigma (statistical quality control)
   • DPDCA (Plan, Do, Check, Act)
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   After implementing a new workflow to reduce alert fatigue, a security operations manager wants to determine whether the change actually improved the situation. The team has been using the new workflow for four weeks. What is the most appropriate way to evaluate the improvement?

   • AWait until the end of the year to review the overall incident response metrics.
   • BCompare the average number of alerts handled per analyst per shift before and after the change, and review the trend over several weeks.
   • CCheck whether the new workflow is being followed and conclude that compliance means success.
   • DAsk the analysts if they feel less fatigued and assume the change is successful if they say yes.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security operations manager wants to improve the accuracy of phishing detection. The team has a monthly meeting where analysts discuss recent phishing campaigns, but attendance is low and the same issues recur. The manager has limited time to implement changes. Which feedback loop design would be most effective in driving sustained improvement?

   • AMandate attendance at the monthly meeting and require each analyst to present one phishing case study.
   • BCreate a short, asynchronous feedback channel where analysts can submit examples of missed or false-positive phishing alerts, and have a senior analyst review and post a weekly summary with lessons learned.
   • CSend a monthly email to the team with a list of common phishing indicators and ask for comments.
   • DCreate a shared dashboard showing phishing detection accuracy metrics and expect analysts to self-correct.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security operations team successfully reduced the average time to contain incidents through a new playbook. Six months later, the manager notices that the team is gradually reverting to old habits and the containment time is increasing. Which practice is most effective for sustaining the improvement?

   • ASend a one-time email reminding the team to follow the playbook.
   • BRely on the team's memory of the playbook since they used it successfully before.
   • CRemove the playbook from the documentation to avoid confusion.
   • DIncorporate the playbook into new-hire training and conduct quarterly refresher sessions with the full team.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A SOC manager is planning to implement a new vulnerability management process. The team is already overworked, and the manager wants to minimize disruption. Which implementation approach is most appropriate?

   • ARoll out the process in phases, starting with a pilot team, and collect feedback before expanding to the full team.
   • BAssign the process to a single analyst who will be responsible for all vulnerability management tasks.
   • CImplement the process all at once to get it done quickly and avoid a prolonged transition.
   • DDelay implementation until the team's workload decreases, without setting a specific timeline.
   Reveal Solution Discussion Select an answer first