A security manager is explaining the layered defense strategy to new SOC analysts. Which statement best describes the purpose of defense-in-depth?

It eliminates the need for monitoring by making the network perimeter impenetrable.

It focuses all security resources on the most critical asset to maximize protection of that single system.

It ensures that a single security control failure does not compromise the entire environment by providing multiple overlapping layers of protection.

It reduces the number of security tools to simplify management and lower operational overhead.

A SOC manager is planning the data collection strategy for a new SIEM deployment. The organization uses a variety of security tools, including firewalls, endpoint detection and response (EDR), and cloud access security broker (CASB) logs. The manager wants to ensure that the SIEM can correlate events across these sources effectively. Which practice is most important to implement?

Use a separate SIEM instance for each log source to avoid mixing data formats.

Store all logs in their native format and require analysts to manually correlate events using multiple dashboards.

Collect only firewall logs because they are the most reliable and ignore EDR and CASB logs to reduce storage costs.

Normalize logs from all sources into a common schema, such as OCSF, and ensure timestamps are standardized to UTC.

A SOC manager is conducting a threat model for a new web application that will handle sensitive customer data. The team has identified that the application is exposed to the internet and has a database backend. Which threat modeling approach would best help prioritize defenses?

Deploy a web application firewall and assume it will block all attacks.

Use a checklist of common vulnerabilities and apply all possible security patches.

Conduct a penetration test after deployment and fix any findings.

Map the application's data flows and trust boundaries, then identify potential attack vectors at each boundary.

During an incident, a SOC analyst observes the attacker using a specific PowerShell command to enumerate Active Directory. The analyst wants to create a detection that would catch this behavior even if the attacker changes the exact command. Which approach is most effective?

Block all PowerShell execution on all endpoints.

Create a detection rule based on the technique of PowerShell being used for Active Directory enumeration.

Search the internet for the exact command and block all related hashes.

Create a SIEM rule that alerts on the exact PowerShell command string.

GIAC Security Operations Manager

Domain 1Objective 1

Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 5)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

12concepts

Questions 21–25

21foundation · easy
A security manager is explaining the layered defense strategy to new SOC analysts. Which statement best describes the purpose of defense-in-depth?
Select an answer first
22application · medium
A SOC manager is planning the data collection strategy for a new SIEM deployment. The organization uses a variety of security tools, including firewalls, endpoint detection and response (EDR), and cloud access security broker (CASB) logs. The manager wants to ensure that the SIEM can correlate events across these sources effectively. Which practice is most important to implement?
Select an answer first
23application · medium
A SOC manager is conducting a threat model for a new web application that will handle sensitive customer data. The team has identified that the application is exposed to the internet and has a database backend. Which threat modeling approach would best help prioritize defenses?
Select an answer first
24foundation · easy
In the threat intelligence lifecycle, which stage comes immediately after 'Collection'?
Select an answer first
25application · medium
During an incident, a SOC analyst observes the attacker using a specific PowerShell command to enumerate Active Directory. The analyst wants to create a detection that would catch this behavior even if the attacker changes the exact command. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 5)

Questions 21–25

A security manager is explaining the layered defense strategy to new SOC analysts. Which statement best describes the purpose of defense-in-depth?

A SOC manager is conducting a threat model for a new web application that will handle sensitive customer data. The team has identified that the application is exposed to the internet and has a database backend. Which threat modeling approach would best help prioritize defenses?

In the threat intelligence lifecycle, which stage comes immediately after 'Collection'?

During an incident, a SOC analyst observes the attacker using a specific PowerShell command to enumerate Active Directory. The analyst wants to create a detection that would catch this behavior even if the attacker changes the exact command. Which approach is most effective?

Keep studying — SOC Strategy and Architecture