How can threat intelligence be integrated into SOC workflows to enhance detection?

By storing intelligence reports in a separate system inaccessible to analysts.

By using intelligence to create detection rules and enrich alerts with context.

By limiting detection to only known indicators from intelligence feeds.

By replacing all existing detection rules with intelligence feeds.

A SOC manager is designing a new secure environment for a high-value application. The requirement is to minimize the attack surface and limit the impact of a potential compromise. Which design principle is most important to apply?

Grant all users full access to the application to simplify management.

Disable logging to reduce the attack surface.

Apply least privilege by giving users only the access they need, and segment the application from other systems.

Place the application on the same network segment as other systems to reduce complexity.

Which component is essential for a logging and monitoring architecture to support effective threat detection?

A centralized log management platform that aggregates and correlates events

A separate logging system for each department to maintain data isolation

A policy that logs are retained for only 24 hours to reduce storage costs

A manual process for analysts to review logs from each source individually

A SOC manager wants to integrate threat intelligence into the SOC workflow. The SOC receives a commercial feed of IOCs and a separate feed of TTPs. The team is overwhelmed by the volume of IOC alerts. Which approach best uses both feeds to improve detection and reduce alert fatigue?

Block all IOCs at the firewall and ignore the TTP feed.

Use the IOC feed to create alerts and the TTP feed to create alerts for every technique.

Use the TTP feed to create behavioral detection rules and use the IOC feed to enrich alerts and prioritize investigations.

Use the IOC feed to create alerts for every indicator and use the TTP feed only for reporting.

GIAC Security Operations Manager

Domain 1Objective 1

Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 7)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

12concepts

Questions 31–35

31application · easy
A SOC manager is establishing a threat intelligence program. The first step is to define what intelligence the SOC needs to support its detection and response priorities. Which stage of the threat intelligence lifecycle does this represent?
Select an answer first
32foundation · easy
How can threat intelligence be integrated into SOC workflows to enhance detection?
Select an answer first
33application · medium
A SOC manager is designing a new secure environment for a high-value application. The requirement is to minimize the attack surface and limit the impact of a potential compromise. Which design principle is most important to apply?
Select an answer first
34foundation · easy
Which component is essential for a logging and monitoring architecture to support effective threat detection?
Select an answer first
35expert · hard
A SOC manager wants to integrate threat intelligence into the SOC workflow. The SOC receives a commercial feed of IOCs and a separate feed of TTPs. The team is overwhelmed by the volume of IOC alerts. Which approach best uses both feeds to improve detection and reduce alert fatigue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.