What is a primary source of data for calculating the SOC metric 'alert false positive rate'?

Network bandwidth utilization reports

SIEM alert logs and analyst disposition records

A SOC manager needs to present a monthly metrics report to a mixed audience of technical analysts and business executives. The report should be clear and actionable for both groups. What is the best approach?

Create two separate reports: one with detailed technical metrics for analysts and one with high-level business impact metrics for executives

Focus only on technical metrics, since analysts are the primary audience

Present a single report with all metrics, both technical and business, in one dashboard

Focus only on business impact metrics, since executives are the primary audience

A SOC manager is asked to provide a metric that demonstrates the SOC's value to the organization's risk management team. The risk team wants to understand how the SOC reduces the likelihood of a major breach. Which metric is most appropriate?

Mean time to respond (MTTR) to all incidents

Percentage of alerts that are triaged within 15 minutes

Number of incidents that were contained before causing significant damage

Number of detection rules in the SIEM

A SOC manager is evaluating the team's detection program. The SIEM generates 10,000 alerts per day, but the team can only investigate 500 per day. The manager wants to use analytics to prioritize which alerts to investigate. Which approach would be most effective?

Use a risk-scoring model that incorporates asset criticality, threat intelligence, and alert confidence

Investigate alerts in the order they are received

Randomly sample alerts for investigation

Investigate only alerts from the most recent hour

A SOC manager wants to calculate the average time to triage for the team. The SIEM records the time an alert is created, and the ticketing system records when an analyst first assigns the ticket to themselves. The manager notices that some alerts are closed without a ticket. What is the best way to handle these alerts when computing the metric?

Exclude alerts without tickets from the calculation

Investigate why alerts are closed without tickets and adjust the data collection process to capture triage time for all alerts

Include alerts without tickets using the time they were closed as the triage time

Use the SIEM's alert creation time and the ticketing system's assignment time only for alerts that have tickets

GIAC Security Operations Manager

Domain 3Objective 2

SOC Analytics and Metrics GSOM Practice Questions (Page 1)

Part of the Performance and Improvement domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 5–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 1–5

1foundation · easy
What is a primary source of data for calculating the SOC metric 'alert false positive rate'?
Select an answer first
2application · medium
A SOC manager needs to present a monthly metrics report to a mixed audience of technical analysts and business executives. The report should be clear and actionable for both groups. What is the best approach?
Select an answer first
3application · medium
A SOC manager is asked to provide a metric that demonstrates the SOC's value to the organization's risk management team. The risk team wants to understand how the SOC reduces the likelihood of a major breach. Which metric is most appropriate?
Select an answer first
4expert · hard
A SOC manager is evaluating the team's detection program. The SIEM generates 10,000 alerts per day, but the team can only investigate 500 per day. The manager wants to use analytics to prioritize which alerts to investigate. Which approach would be most effective?
Select an answer first
5application · medium
A SOC manager wants to calculate the average time to triage for the team. The SIEM records the time an alert is created, and the ticketing system records when an analyst first assigns the ticket to themselves. The manager notices that some alerts are closed without a ticket. What is the best way to handle these alerts when computing the metric?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.