A SOC manager wants to measure the effectiveness of the SOC's detection capabilities. Which metric is most directly tied to the quality of detection?

Mean time to respond (MTTR) to incidents.

Number of alerts generated per day.

Percentage of alerts that are true positives.

Number of threat intelligence feeds subscribed to.

Which statement correctly describes the role of the SOC within an organization's overall security program?

The SOC is primarily responsible for designing and implementing all security controls across the enterprise.

The SOC's main duty is to conduct annual penetration tests and vulnerability assessments.

The SOC is the final authority for setting organizational security policy and risk tolerance.

The SOC is responsible for the ongoing monitoring, detection, analysis, and response to security incidents.

What is the primary purpose of threat modeling?

To create a list of all known malware signatures.

To simulate a full-scale cyber attack on the production environment.

To calculate the financial cost of a potential data breach.

To identify and prioritize potential attack vectors and inform security controls.

Which of the following is an example of an open-source threat intelligence (OSINT) source?

A vendor-specific threat feed that requires a paid subscription

Internal telemetry collected from the organization's own network sensors

Publicly available security blogs, forums, and government advisories

A private information-sharing community restricted to vetted members

GIAC Security Operations Manager

Domain 1Objective 1

Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 1)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

12concepts

Questions 1–5

1application · medium
A SOC manager wants to measure the effectiveness of the SOC's detection capabilities. Which metric is most directly tied to the quality of detection?
Select an answer first
2foundation · easy
Which statement correctly describes the role of the SOC within an organization's overall security program?
Select an answer first
3application · easy
A SOC manager is explaining to a new analyst why the organization uses multiple layers of security controls, including firewalls, intrusion detection, and endpoint protection. Which principle is the manager illustrating?
Select an answer first
4foundation · easy
What is the primary purpose of threat modeling?
Select an answer first
5foundation · easy
Which of the following is an example of an open-source threat intelligence (OSINT) source?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.