Continuous Improvement GSOM Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security operations team has been using Kaizen events to make incremental improvements, but the improvements are often not sustained after the event ends. The manager wants to embed continuous improvement into the team's culture. Which action would best support this goal?

   • AIncorporate continuous improvement goals into each analyst's performance review and recognize team members who contribute ideas.
   • BHold a monthly Kaizen event to generate new ideas, but do not track the outcomes of previous events.
   • CAssign a single continuous improvement champion who is responsible for all improvement initiatives.
   • DCreate a suggestion box and encourage analysts to submit ideas, but do not allocate time to implement them.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security operations manager is evaluating the performance of the SOC's threat detection capabilities. The manager wants to use a metric that reflects the accuracy of the detection process, specifically the proportion of alerts that are true positives. Which metric should the manager use?

   • ARecall, calculated as true positives divided by the total number of actual incidents (true positives plus false negatives).
   • BMean time to detect (MTTD), measuring the average time to identify an incident.
   • CNumber of alerts per day, measuring the volume of alerts generated.
   • DPrecision, calculated as true positives divided by the total number of alerts (true positives plus false positives).
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security operations manager is reviewing the SOC's performance metrics and notices that the mean time to respond (MTTR) has decreased, but the number of incidents that recur within 30 days has increased. The manager suspects that the faster response may be leading to incomplete remediation. The manager wants to evaluate this hypothesis without spending excessive analyst time. Which approach is most appropriate?

   • AInterview the analysts who handled the recurring incidents to ask why they think the incidents recurred.
   • BReview the incident reports for the recurring incidents to identify commonalities.
   • CCorrelate the MTTR data with the recurrence data to see if incidents with faster response times are more likely to recur.
   • DIncrease the MTTR target to allow more time for thorough remediation.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security operations team implemented a new process to reduce the time to escalate incidents. After three months, the average escalation time has decreased, but the number of incidents that require re-escalation has increased. The manager needs to decide whether the process is effective. What is the most appropriate evaluation?

   • AConclude that the process is effective because the primary metric improved.
   • BRevert to the old process because the re-escalation rate increased.
   • CSet a new target for re-escalation rate and continue the process unchanged.
   • DAnalyze the re-escalation data to determine if the faster escalation is leading to premature escalations that are later corrected.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which continuous improvement model is commonly associated with Six Sigma and includes the phases Define, Measure, Analyze, Improve, and Control?

   • AAgile
   • BPDCA
   • CDMAIC
   • DKaizen
   Reveal Solution Discussion Select an answer first