A company is designing a new SOC and wants to ensure it can measure its performance and improve over time. Which component should be included in the SOC management system to support this goal?

A metrics dashboard that tracks KPIs and trends

A firewall with intrusion prevention capabilities

A backup solution for log storage

A VPN for remote access to the SOC network

A company is establishing a new SOC. The management wants to ensure that the SOC has the necessary components to detect, triage, and respond to incidents effectively. Which set of components is essential for a SOC management system?

Firewall, antivirus software, and VPN concentrator

SIEM platform, ticketing system, and documented incident response procedures

Data loss prevention (DLP) system, endpoint detection and response (EDR), and intrusion prevention system (IPS)

Penetration testing tools, vulnerability scanner, and compliance audit reports

What does the KPI 'Mean Time to Respond (MTTR)' measure in a SOC context?

The time to update antivirus signatures

The average time taken to contain and remediate an incident after detection

The time it takes to hire a new SOC analyst

The average time between two incidents

Which of the following best describes the primary purpose of a Security Operations Center (SOC) management system?

To automate all security decisions without human intervention

To centralize and coordinate an organization's security monitoring, detection, and response activities

To replace the need for individual security tools by providing a single all-in-one application

To manage the organization's overall IT infrastructure and network performance

A multinational company operates a SOC that handles personal data for customers in both the EU and the US. The SOC manager must ensure that incident response processes comply with both GDPR and any applicable US regulations. During a data breach, the SOC team identifies that the breach affects EU residents. Which action must the SOC manager take to comply with GDPR?

Wait until the investigation is complete before notifying any authority.

Notify only the US authorities because the company is headquartered in the US.

Notify the relevant EU supervisory authority within 72 hours of becoming aware of the breach.

Notify affected individuals first, then the supervisory authority.

GIAC Security Operations Certified

Domain 1Objective 3

SOC Management Systems GSOC Practice Questions (Page 7)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 31–35

31application · medium
A company is designing a new SOC and wants to ensure it can measure its performance and improve over time. Which component should be included in the SOC management system to support this goal?
Select an answer first
32application · medium
A company is establishing a new SOC. The management wants to ensure that the SOC has the necessary components to detect, triage, and respond to incidents effectively. Which set of components is essential for a SOC management system?
Select an answer first
33foundation · easy
What does the KPI 'Mean Time to Respond (MTTR)' measure in a SOC context?
Select an answer first
34foundation · easy
Which of the following best describes the primary purpose of a Security Operations Center (SOC) management system?
Select an answer first
35expert · hard
A multinational company operates a SOC that handles personal data for customers in both the EU and the US. The SOC manager must ensure that incident response processes comply with both GDPR and any applicable US regulations. During a data breach, the SOC team identifies that the breach affects EU residents. Which action must the SOC manager take to comply with GDPR?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.