Continuous Improvement GSOM Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of a security operations KPI?

   • ANumber of employees in the SOC
   • BVendor contract renewal date
   • CMean time to detect (MTTD)
   • DOffice temperature
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of using key performance indicators (KPIs) in security operations?

   • ATo satisfy regulatory requirements only
   • BTo automate security monitoring tasks
   • CTo replace the need for incident response procedures
   • DTo provide a quantitative basis for measuring and improving performance
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security operations team implemented a new alert enrichment process three months ago. The manager wants to evaluate whether the process has achieved its goal of reducing alert investigation time. Which evaluation approach is most appropriate?

   • ACompare the average investigation time for the three months after implementation to the average for the three months before implementation.
   • BReview the process documentation to ensure it is being followed, and consider that sufficient.
   • CAsk analysts whether they feel the process has saved time, and use their opinions as the primary measure.
   • DTrack the number of alerts enriched per day and assume that more enrichment means better performance.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A SOC manager is evaluating the performance of two detection rules. Rule A generates 200 alerts per week with a 5% true positive rate. Rule B generates 20 alerts per week with a 50% true positive rate. The team has limited analyst time. Which metric would best guide the decision to keep, tune, or remove a rule?

   • ANumber of true positives per week, because it shows the rule's contribution to detecting real threats.
   • BFalse positive rate, because it directly indicates how much analyst time is wasted on non-threats.
   • CSignal-to-noise ratio, because it balances the value of true positives against the cost of false positives.
   • DTotal alert volume, because it shows the workload impact on the team.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security operations manager wants to reduce the number of missed critical alerts during overnight shifts. The team has agreed on a new alert-handling procedure. The manager needs to develop an improvement plan that includes clear objectives, resource allocation, and a way to measure success. Which plan element is most essential to include?

   • AA list of all possible causes of missed alerts without prioritizing them.
   • BA decision to purchase new alerting software without specifying how it will be used.
   • CA specific target, such as reducing missed critical alerts by 50% within three months, with assigned team members and weekly progress reviews.
   • DA general statement that the team should be more careful during overnight shifts.
   Reveal Solution Discussion Select an answer first