Why are TTPs generally considered more valuable than IOCs for long-term detection strategy?

TTPs can be automatically generated from any IOC feed.

TTPs are easier to automate in SIEM rules than IOCs.

TTPs are less likely to change than IOCs, providing more durable detection value.

TTPs are always unique to a single threat actor, making attribution easier.

A company is implementing zero trust and the SOC manager must ensure that the SOC can monitor access decisions. The company uses a mix of on-premises and cloud applications. Which approach best supports zero trust monitoring?

Use a VPN for all access and trust the VPN as the security boundary.

Rely on the cloud provider's logs for all access decisions.

Log all access requests and continuously verify user and device identity for each request.

Log only failed access attempts to reduce noise.

What is the primary security benefit of network segmentation?

It increases network speed by reducing broadcast domains.

It limits lateral movement by restricting communication between network zones.

It eliminates the need for endpoint protection.

It allows all traffic to flow freely while being monitored centrally.

A SOC manager is responsible for a multi-tenant environment where different business units host applications with varying sensitivity levels. The manager wants to implement network segmentation to limit lateral movement, but the business units have conflicting requirements: one unit needs to share data with another unit's application, and a third unit requires low-latency access to a shared database. The manager must balance security with operational needs. Which segmentation strategy is most appropriate?

Place all business units on a single flat network and rely on application-level authentication to protect sensitive data.

Segment only the most sensitive business unit and leave all other units on a shared network to reduce complexity.

Create a single segment for all business units but use a next-generation firewall to inspect all traffic and block any suspicious activity.

Create separate segments for each business unit, and use micro-segmentation within each segment to allow only the specific communication paths required for data sharing and database access.

What is a key benefit of using threat intelligence to prioritize alerts in a SOC?

It eliminates the need for manual alert triage.

It reduces the total number of alerts generated by the SIEM.

It automatically remediates all high-priority alerts.

It allows analysts to focus on alerts that are most relevant to the organization's threat landscape.

GIAC Security Operations Manager

Domain 1Objective 1

Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 3)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

12concepts

Questions 11–15

11foundation · easy
Why are TTPs generally considered more valuable than IOCs for long-term detection strategy?
Select an answer first
12expert · hard
A company is implementing zero trust and the SOC manager must ensure that the SOC can monitor access decisions. The company uses a mix of on-premises and cloud applications. Which approach best supports zero trust monitoring?
Select an answer first
13foundation · easy
What is the primary security benefit of network segmentation?
Select an answer first
14expert · hard
A SOC manager is responsible for a multi-tenant environment where different business units host applications with varying sensitivity levels. The manager wants to implement network segmentation to limit lateral movement, but the business units have conflicting requirements: one unit needs to share data with another unit's application, and a third unit requires low-latency access to a shared database. The manager must balance security with operational needs. Which segmentation strategy is most appropriate?
Select an answer first
15foundation · easy
What is a key benefit of using threat intelligence to prioritize alerts in a SOC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.