Which of the following is a typical characteristic of a SOC at the 'Initial' or 'Ad Hoc' maturity level?

Automation is fully integrated into all workflows

Processes are standardized and consistently followed across the team

Processes are undocumented and depend on individual expertise

Continuous improvement is driven by metrics and feedback loops

A SOC uses a SIEM for detection and a ticketing system for tracking. Analysts spend significant time manually gathering context for each alert, such as pulling user information and asset details. Which technology would most directly reduce this manual effort?

SOAR platform with automated enrichment playbooks

Additional SIEM storage capacity

A vulnerability management platform

A new firewall with advanced logging

A SOC manager is evaluating the maturity of their SOC using the CMMI model. The SOC has well-defined processes and uses metrics to track performance, but the processes are not consistently followed across shifts, and improvements are not systematically implemented. Which maturity level best describes this SOC?

Level 4: Quantitatively Managed

A SOC receives an alert for a potential malware infection on a workstation. According to standard SOC workflow, what should the analyst do first?

Triage the alert to confirm it is a true positive before taking action

Escalate the alert to the incident response team

Immediately isolate the workstation from the network

Close the alert as a false positive if the antivirus shows no infection

GIAC Security Operations Certified

Domain 1Objective 3

SOC Management Systems GSOC Practice Questions (Page 4)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 16–20

16foundation · easy
Which of the following is a typical characteristic of a SOC at the 'Initial' or 'Ad Hoc' maturity level?
Select an answer first
17application · medium
A SOC manager is assessing the maturity of their SOC using a maturity model. They observe that incident response procedures are documented but not consistently followed, and metrics are collected but not used to drive improvements. According to common maturity models, which stage best describes this SOC?
Select an answer first
18application · medium
A SOC uses a SIEM for detection and a ticketing system for tracking. Analysts spend significant time manually gathering context for each alert, such as pulling user information and asset details. Which technology would most directly reduce this manual effort?
Select an answer first
19expert · hard
A SOC manager is evaluating the maturity of their SOC using the CMMI model. The SOC has well-defined processes and uses metrics to track performance, but the processes are not consistently followed across shifts, and improvements are not systematically implemented. Which maturity level best describes this SOC?
Select an answer first
20application · medium
A SOC receives an alert for a potential malware infection on a workstation. According to standard SOC workflow, what should the analyst do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

SOC Management Systems GSOC Practice Questions (Page 4)

Questions 16–20

Which of the following is a typical characteristic of a SOC at the 'Initial' or 'Ad Hoc' maturity level?

A SOC uses a SIEM for detection and a ticketing system for tracking. Analysts spend significant time manually gathering context for each alert, such as pulling user information and asset details. Which technology would most directly reduce this manual effort?

A SOC receives an alert for a potential malware infection on a workstation. According to standard SOC workflow, what should the analyst do first?

Keep studying — Security Operations Fundamentals