A SOC manager is reviewing the incident response plan to ensure it aligns with the NIST Cybersecurity Framework. Which practice best reflects the 'Respond' function?

Executing a predefined playbook to contain and eradicate a confirmed incident.

Implementing a SIEM to collect and correlate logs from all sources.

Developing a business continuity plan to ensure operations continue during a disruption.

Conducting regular vulnerability scans to identify weaknesses.

A company is designing a new SOC and wants to ensure it has the core components of a management system. Which combination best represents the essential components?

Analysts, managers, and directors

Detection, response, and recovery

People, processes, and technology

A SOC is considering implementing a SOAR platform to automate incident response. The team has a mature SIEM and a ticketing system. The SOC manager wants to ensure that the SOAR platform integrates effectively with existing tools and does not create additional manual work. Which consideration is most important when selecting a SOAR platform?

The platform's ability to integrate with the existing SIEM and ticketing system via APIs

The vendor's customer support availability

The number of pre-built playbooks included with the platform

The cost of the platform compared to other options

In a standard SOC workflow, what is the correct sequence of steps for handling a potential security incident?

Analysis, Detection, Triage, Recovery, Response

Detection, Triage, Analysis, Response, Recovery

Recovery, Response, Analysis, Triage, Detection

Triage, Detection, Response, Analysis, Recovery

GIAC Security Operations Certified

Domain 1Objective 3

SOC Management Systems GSOC Practice Questions (Page 2)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 6–10

6application · medium
A SOC manager is reviewing the incident response plan to ensure it aligns with the NIST Cybersecurity Framework. Which practice best reflects the 'Respond' function?
Select an answer first
7application · medium
A company is designing a new SOC and wants to ensure it has the core components of a management system. Which combination best represents the essential components?
Select an answer first
8expert · hard
A SOC is considering implementing a SOAR platform to automate incident response. The team has a mature SIEM and a ticketing system. The SOC manager wants to ensure that the SOAR platform integrates effectively with existing tools and does not create additional manual work. Which consideration is most important when selecting a SOAR platform?
Select an answer first
9foundation · easy
Which of the following is a common governance framework that influences SOC management practices?
Select an answer first
10foundation · easy
In a standard SOC workflow, what is the correct sequence of steps for handling a potential security incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

SOC Management Systems GSOC Practice Questions (Page 2)

Questions 6–10

A SOC manager is reviewing the incident response plan to ensure it aligns with the NIST Cybersecurity Framework. Which practice best reflects the 'Respond' function?

A company is designing a new SOC and wants to ensure it has the core components of a management system. Which combination best represents the essential components?

Which of the following is a common governance framework that influences SOC management practices?

In a standard SOC workflow, what is the correct sequence of steps for handling a potential security incident?

Keep studying — Security Operations Fundamentals