After a security incident, the post-incident review reveals that the malicious activity was present in the environment for 45 days before detection. The detection team wants to implement a continuous improvement loop to reduce dwell time. Which action is most aligned with this goal?

Require all analysts to work overtime to manually review logs from the past 45 days.

Increase the log retention period to 90 days to ensure more data is available for future investigations.

Replace the SIEM platform with a new one that has more built-in correlation rules.

Conduct a retrospective to identify detection gaps and then create or tune detection rules to cover the missed TTPs.

What is the primary purpose of proactive detection in a security operations center?

To eliminate the need for reactive incident response by preventing all attacks.

To identify and respond to threats before they cause significant damage, reducing dwell time.

To replace all automated alerting with manual analysis of every event.

To ensure that all security incidents are automatically remediated without human intervention.

A SOC manager wants to reduce the average dwell time of threats in the environment. The current detection approach relies primarily on signature-based alerts from the SIEM. Which change would most directly support proactive detection and reduce dwell time?

Increase the frequency of signature updates on the SIEM.

Reduce the alert threshold for all existing rules to catch more events.

Add more SIEM correlation rules based on known attack patterns.

Implement a threat hunting program that uses hypothesis-driven searches across endpoint and network data.

What is the purpose of a continuous improvement loop in detection operations?

To certify that the SOC meets compliance requirements

To refine detection content and processes based on lessons learned and evolving threats

To ensure that all alerts are closed within 24 hours

To replace human analysts with automated systems

After a security incident, the SOC team reviews the detection rules that fired and finds that several rules had high false-positive rates, while one critical attack path was not detected at all. The team wants to establish a continuous improvement loop. Which action best supports this goal?

Wait for the next incident to see if the rules perform better.

Delete all rules that produced false positives during the incident.

Conduct a post-incident review to identify detection gaps, then update rules and test them against the incident data.

Increase the severity of all detection rules to ensure future incidents are noticed.

GIAC Security Operations Manager

Domain 2Objective 3

Proactive Detection and Analysis GSOM Practice Questions (Page 2)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

7concepts

Questions 6–10

6application · medium
After a security incident, the post-incident review reveals that the malicious activity was present in the environment for 45 days before detection. The detection team wants to implement a continuous improvement loop to reduce dwell time. Which action is most aligned with this goal?
Select an answer first
7foundation · easy
What is the primary purpose of proactive detection in a security operations center?
Select an answer first
8application · medium
A SOC manager wants to reduce the average dwell time of threats in the environment. The current detection approach relies primarily on signature-based alerts from the SIEM. Which change would most directly support proactive detection and reduce dwell time?
Select an answer first
9foundation · easy
What is the purpose of a continuous improvement loop in detection operations?
Select an answer first
10application · medium
After a security incident, the SOC team reviews the detection rules that fired and finds that several rules had high false-positive rates, while one critical attack path was not detected at all. The team wants to establish a continuous improvement loop. Which action best supports this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.