Continuous Improvement GSOM Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC manager is planning to implement a new SOAR platform to automate alert triage. The team is resistant to change and worried about job security. The budget is approved, but the implementation timeline is tight. Which approach best balances the need for a successful implementation with the team's concerns?

   • ADelay the implementation until the team is fully comfortable with the idea, without a specific timeline.
   • BInvolve analysts in the selection and configuration of the SOAR playbooks, and communicate that the platform will handle repetitive tasks, allowing them to focus on complex investigations.
   • CImplement the SOAR platform with default playbooks and provide minimal training to meet the timeline.
   • DAssign a single analyst to manage the SOAR platform and automate as many tasks as possible, without involving the rest of the team.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the main objective of root cause analysis (RCA) in security incident management?

   • ATo document the incident for legal purposes
   • BTo restore systems to normal operation as quickly as possible
   • CTo assign blame to the individual who caused the incident
   • DTo identify the underlying cause of an incident to prevent recurrence
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC manager wants to evaluate whether a new alert triage workflow has improved efficiency. The team has been using the workflow for two weeks. Which metric set would best measure the improvement's effectiveness while avoiding misleading conclusions?

   • ACustomer satisfaction score and the number of training hours completed by analysts.
   • BNumber of false positives and the total time spent in meetings per analyst per week.
   • CMean time to triage (MTTT) and the percentage of alerts closed without escalation, compared against a baseline from the previous quarter.
   • DTotal number of alerts processed and the number of open tickets at the end of each day.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations manager is planning to implement a new vulnerability management process. The team is already overloaded with daily operations, and the manager is concerned about resistance to change. Which approach is most likely to gain team buy-in and ensure successful implementation?

   • AInvolve the team in the planning phase, clearly explain the benefits, and phase the rollout to minimize disruption.
   • BDelay implementation until the team is less busy, without a specific plan.
   • CImplement the process only for new team members and leave existing staff on the old process.
   • DMandate the new process and require immediate compliance from all team members.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security operations team has successfully improved its incident response times through a series of process changes. The manager wants to ensure these improvements are sustained over the long term, especially as team members come and go. Which combination of practices is most effective for sustaining the improvements?

   • ACreate a one-time training session for the current team and assume it will be sufficient.
   • BRely on the current team members to remember the processes and share them informally with new hires.
   • CMonitor the key metrics monthly and only take action if the metrics degrade significantly.
   • DDocument the new processes in the team's knowledge base, include them in onboarding for new hires, and conduct quarterly process reviews.
   Reveal Solution Discussion Select an answer first