A security operations manager wants to improve the quality of incident reports. Currently, reports are written after each incident and reviewed by the manager, but the analysts do not see the feedback. Which feedback loop would most directly improve report quality?

Track the number of reports that need revision and share the metric with the team.

Publish a monthly summary of common report errors in the team newsletter.

Create a template for incident reports and require all analysts to use it.

Have the manager provide written feedback on each report and schedule a brief one-on-one with the analyst to discuss it.

Which activity is part of evaluating the outcomes of an improvement initiative?

Comparing post-implementation metrics to baseline metrics

Celebrating the completion of the project

Deleting all pre-implementation data

Immediately moving on to the next improvement

A SOC manager wants to measure the effectiveness of a new threat intelligence feed that was added to improve detection of emerging threats. Which KPI would best indicate whether the feed is providing value?

Number of new indicators of compromise (IOCs) added to the threat intelligence platform from the feed.

Percentage of alerts generated by the new feed that are confirmed as true positives.

Time spent by analysts investigating alerts from the new feed.

Total number of alerts generated by the new feed per day.

GIAC Security Operations Manager

Domain 3Objective 1

Continuous Improvement GSOM Practice Questions (Page 11)

Part of the Performance and Improvement domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 51–54

51foundation · easy
Which continuous improvement model is best described as a philosophy that encourages small, incremental changes on a regular basis?
Select an answer first
52application · medium
A security operations manager wants to improve the quality of incident reports. Currently, reports are written after each incident and reviewed by the manager, but the analysts do not see the feedback. Which feedback loop would most directly improve report quality?
Select an answer first
53foundation · easy
Which activity is part of evaluating the outcomes of an improvement initiative?
Select an answer first
54application · medium
A SOC manager wants to measure the effectiveness of a new threat intelligence feed that was added to improve detection of emerging threats. Which KPI would best indicate whether the feed is providing value?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.