Continuous Improvement GSOM Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations manager wants to establish a feedback loop to improve incident response playbooks. The team has a monthly operations review, but analysts rarely contribute. Which action would most effectively create a sustainable feedback mechanism?

   • AHold a dedicated feedback session at the end of each incident, asking analysts what went wrong during that specific response.
   • BSend a quarterly survey to all analysts asking for their top three playbook frustrations.
   • CCreate a shared document where analysts can anonymously suggest playbook improvements, and review those suggestions during the monthly operations review.
   • DRequire every analyst to submit at least one playbook change per month, with a manager approving all changes.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security operations team successfully reduced false positives by updating detection rules, but after two months, the false positive rate is creeping back up. The manager wants to sustain the improvement. Which practice would best reinforce the change?

   • AIncrease the false positive threshold in the SIEM to automatically suppress more alerts.
   • BReward the analyst who created the new rules with a bonus and move on to other projects.
   • CDocument the new rules in the team wiki and consider the project complete.
   • DSchedule a quarterly review of detection rules and false positive metrics, and include rule tuning as a standing agenda item in team meetings.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security operations team implemented a new process to reduce the number of repeat incidents. After three months, the repeat incident rate has not changed. The manager is considering whether to continue the process or abandon it. Which evaluation approach would provide the most reliable basis for this decision?

   • AAnalyze the repeat incidents to determine whether the process was actually followed, and whether the root causes of the repeats are within the process's scope.
   • BExtend the evaluation period for another three months to see if the process eventually shows results.
   • CAsk the team whether they think the process is working and make a decision based on their feedback.
   • DCompare the repeat incident rate to the industry average and decide based on that benchmark.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security operations manager wants to foster a culture of continuous improvement within the SOC. The manager has noticed that analysts are hesitant to report near-misses or minor process inefficiencies because they fear being blamed. Which action is most aligned with the principles of continuous improvement?

   • AEstablish a non-punitive reporting process for near-misses and review them in team meetings as learning opportunities.
   • BKeep near-miss reports confidential and only share them with senior management.
   • CReward analysts who find errors in others' work to increase accountability.
   • DEncourage analysts to report issues only if they are confident the issue will lead to a major incident.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security operations team has been experiencing an increasing number of false-positive alerts from a specific intrusion detection rule. The team has been tuning the rule repeatedly, but the false positives persist. The manager wants to identify the underlying reason before making further changes. Which approach best supports this goal?

   • AIncrease the alert threshold to reduce the volume of false positives immediately.
   • BConduct a root cause analysis using the 5 Whys technique to trace the alert pattern to its source.
   • CDisable the rule and rely on other detection mechanisms for coverage.
   • DReview the false-positive rate metric and set a target to lower it next quarter.
   Reveal Solution Discussion Select an answer first