GIAC (SANS)GIAC Security Operations Manager
The GIAC Security Operations Manager (GSOM) certification validates your ability to lead a capable Security Operations Center (SOC) using advanced frameworks, tools, and leadership skills. Designed for SOC managers, leads, and technical CISOs, it proves you can strategically operate an SOC aligned with business goals and security requirements. Earning GSOM demonstrates you can field an effective SOC and drive continuous improvement.
496 practice questions · Updated 2026-07-30
3Domains
10Objectives
80Concepts
496Questions
GSOM Curriculum
Every domain, objective, and concept the GSOM exam measures.
- Cyber Defense Theory Foundations
- Threat Intelligence Lifecycle
- Threat Intelligence Sources and Types
- Indicators of Compromise (IOCs) and TTPs
- Defensible Architecture Principles
- Network Segmentation and Micro-segmentation
- Zero Trust Architecture
- Logging and Monitoring Architecture
- Data Collection and Normalization
- SOC Metrics and Performance Measurement
- Integration of Threat Intel into SOC Operations
- Threat Modeling and Attack Surface Analysis
- SOC Design Principles
- SOC Architecture Models
- SOC Functional Components
- SOC Staffing and Roles
- SOC Technology Stack
- SOC Processes and Workflows
- SOC Metrics and KPIs
- SOC Maturity Model
- SOC Budgeting and Resource Allocation
- SOC Integration with Business
- SOC Tool Categories
- Tool Selection Criteria
- Tool Integration and Data Flow
- Automation and Orchestration
- Tool Maintenance and Lifecycle
- Identify Data Sources
- Assess Data Quality
- Determine Collection Methods
- Plan Data Retention
- Integrate Data Sources
- Validate Data Collection
- Alert Creation Workflow
- Alert Tuning and Optimization
- Alert Prioritization and Severity
- Alert Lifecycle Management
- Alert Documentation and Communication
- Proactive Detection Fundamentals
- Threat Hunting Methodologies
- Hypothesis-Driven Analysis
- Detection Engineering
- Data Source Integration
- Attack Pattern Recognition
- Continuous Improvement Loop
- Incident Response Lifecycle
- Incident Response Plan Components
- Incident Classification and Prioritization
- Incident Response Team Roles
- Containment Strategies
- Eradication and Recovery Procedures
- Evidence Handling and Chain of Custody
- Communication and Reporting During Incidents
- Post-Incident Review and Lessons Learned
- Coordination with External Entities
- Legal and Regulatory Considerations
- Incident Response Metrics and Performance
- Incident Response Preparation
- Incident Response Policy and Procedures
- Incident Response Team Roles and Responsibilities
- Incident Response Plan Development
- Incident Response Plan Testing and Validation
- Incident Response Training and Awareness
- Incident Response Tools and Resources
- Coordination with External Entities
- Continuous Improvement Fundamentals
- Continuous Improvement Models
- Metrics and KPIs for Improvement
- Root Cause Analysis
- Feedback Loops
- Improvement Planning and Implementation
- Monitoring and Evaluating Improvements
- Sustaining Continuous Improvement
- Define SOC Analytics
- Identify SOC Metrics
- Map Metrics to Objectives
- Collect Metric Data
- Analyze Metric Trends
- Report SOC Performance
- Use Analytics for Improvement
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GSOM, so none is invented.