A SOC must comply with GDPR when handling personal data of EU citizens. Which practice is most directly required by GDPR?

Deleting all logs after 30 days

Ensuring that personal data is processed lawfully, fairly, and transparently

Encrypting all personal data at rest

Storing all personal data on-premises

What is the primary purpose of the triage step in a SOC incident workflow?

To prioritize alerts based on severity and potential impact

To permanently delete false positive alerts

To document the incident for legal purposes

To automatically remediate all detected threats

A SOC has a team of five analysts. During a large-scale incident, the SOC manager assigns one analyst to lead the investigation, one to handle communication with management, one to monitor the SIEM for new alerts, and two to perform containment. The incident requires deep forensic analysis. Which adjustment best improves the team's effectiveness?

Reassign the communication role to the SOC manager and have the analyst focus on forensics

Assign the lead analyst to also perform forensic analysis

Ask the containment analysts to also do forensics

Have the SIEM monitor analyst also perform forensics

What is the primary function of a Security Orchestration, Automation, and Response (SOAR) platform in a SOC?

To automate and orchestrate incident response workflows

To perform deep packet inspection on network traffic

To replace the SIEM system entirely

To manage user identities and access permissions

A SOC uses a SIEM, a ticketing system, and a SOAR. The team notices that alerts are not being consistently enriched with threat intelligence before being assigned to analysts. Which integration is most likely missing?

SIEM to ticketing system integration

SOAR to ticketing system integration

Threat intelligence platform to SIEM integration

GIAC Security Operations Certified

Domain 1Objective 3

SOC Management Systems GSOC Practice Questions (Page 6)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 26–30

26application · medium
A SOC must comply with GDPR when handling personal data of EU citizens. Which practice is most directly required by GDPR?
Select an answer first
27foundation · easy
What is the primary purpose of the triage step in a SOC incident workflow?
Select an answer first
28expert · hard
A SOC has a team of five analysts. During a large-scale incident, the SOC manager assigns one analyst to lead the investigation, one to handle communication with management, one to monitor the SIEM for new alerts, and two to perform containment. The incident requires deep forensic analysis. Which adjustment best improves the team's effectiveness?
Select an answer first
29foundation · easy
What is the primary function of a Security Orchestration, Automation, and Response (SOAR) platform in a SOC?
Select an answer first
30expert · hard
A SOC uses a SIEM, a ticketing system, and a SOAR. The team notices that alerts are not being consistently enriched with threat intelligence before being assigned to analysts. Which integration is most likely missing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.