A SOC manager finds that the 'percentage of alerts that are true positives' has been declining for six months. The SOC has not changed its detection rules or tooling. What is the most likely cause?

The threat landscape has shifted, and the current rules are no longer effective

The SOC is now detecting more sophisticated attacks

Analysts are becoming less skilled at identifying true positives

The SIEM is ingesting more data, which increases false positives

A SOC manager wants to compute the false positive rate for the team's detection rules. The SIEM contains alert records, but the analyst disposition (true positive vs. false positive) is recorded in a separate ticketing system. What is the most reliable way to collect the data needed for this metric?

Count alerts in the SIEM that were not escalated to tickets

Ask analysts to manually estimate the false positive percentage each month

Use the number of tickets closed as 'not an incident' as the false positive count

Join SIEM alert records with ticketing system dispositions using a common alert ID

A SOC manager notices that the number of incidents has decreased by 30% over the past quarter, but the mean time to detect (MTTD) has increased by 50%. The manager suspects that the decrease in incidents is due to a change in detection rules. What is the most appropriate interpretation?

The rule change may have reduced detection coverage, causing fewer incidents to be detected and longer times to detect them

The increase in MTTD is unrelated to the decrease in incidents

The SOC is performing better because fewer incidents are occurring

The decrease in incidents is a positive outcome and the increase in MTTD is a separate issue

After analyzing monthly metrics, a SOC manager identifies that Mean Time to Respond (MTTR) has increased due to delays in the escalation process. What is the most appropriate improvement action?

Increase the MTTR target to make the metric look better

Add more steps to the escalation process to ensure thoroughness

Reduce the number of incident responders

Streamline the escalation workflow and automate notifications

GIAC Security Operations Manager

Domain 3Objective 2

SOC Analytics and Metrics GSOM Practice Questions (Page 7)

Part of the Performance and Improvement domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 5–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 31–35

31application · medium
A SOC manager finds that the 'percentage of alerts that are true positives' has been declining for six months. The SOC has not changed its detection rules or tooling. What is the most likely cause?
Select an answer first
32foundation · easy
Which metric is commonly used to measure the efficiency of a SOC's incident detection process?
Select an answer first
33application · medium
A SOC manager wants to compute the false positive rate for the team's detection rules. The SIEM contains alert records, but the analyst disposition (true positive vs. false positive) is recorded in a separate ticketing system. What is the most reliable way to collect the data needed for this metric?
Select an answer first
34expert · hard
A SOC manager notices that the number of incidents has decreased by 30% over the past quarter, but the mean time to detect (MTTD) has increased by 50%. The manager suspects that the decrease in incidents is due to a change in detection rules. What is the most appropriate interpretation?
Select an answer first
35foundation · easy
After analyzing monthly metrics, a SOC manager identifies that Mean Time to Respond (MTTR) has increased due to delays in the escalation process. What is the most appropriate improvement action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

SOC Analytics and Metrics GSOM Practice Questions (Page 7)

Questions 31–35

A SOC manager finds that the 'percentage of alerts that are true positives' has been declining for six months. The SOC has not changed its detection rules or tooling. What is the most likely cause?

Which metric is commonly used to measure the efficiency of a SOC's incident detection process?

A SOC manager notices that the number of incidents has decreased by 30% over the past quarter, but the mean time to detect (MTTD) has increased by 50%. The manager suspects that the decrease in incidents is due to a change in detection rules. What is the most appropriate interpretation?

After analyzing monthly metrics, a SOC manager identifies that Mean Time to Respond (MTTR) has increased due to delays in the escalation process. What is the most appropriate improvement action?

Keep studying — Performance and Improvement