A SOC manager is selecting a SIEM platform. The organization has a distributed architecture with data centers in multiple regions. The manager needs to ensure that the SIEM can collect and correlate data from all regions while meeting data residency requirements. Which SIEM deployment model is most appropriate?

A cloud-based SIEM with data stored in a single global location

Distributed SIEM collectors in each region with a central correlation engine

A single centralized SIEM instance in one region

A SIEM that only collects data from the central data center

A SOC manager is designing a new SOC and wants to ensure that all functional components are covered. The manager has already identified the need for a SIEM, a ticketing system, and a team of analysts. Which additional component is essential to complete the functional picture?

A custom-built threat intelligence platform

A documented incident response plan and associated procedures

A dedicated physical SOC facility with a large screen

A healthcare organization is designing a SOC and must comply with HIPAA, which requires safeguarding electronic protected health information (ePHI). The SOC will handle alerts that may contain patient data. Which design choice best aligns the SOC with this compliance obligation?

Avoid collecting logs that might contain ePHI to reduce compliance burden

Store all logs in a central repository without access controls to ensure analysts can investigate any alert

Use a public cloud SIEM because the cloud provider is responsible for all HIPAA compliance

Ensure the SIEM is configured to encrypt data at rest and in transit, and restrict access to ePHI to only those analysts with a need to know

A SOC team is designing its incident response workflow. The organization has a regulatory requirement to report certain incidents within 24 hours. The team wants to ensure that this requirement is met without overwhelming the analysts. Which workflow design is most effective?

Automatically escalate all incidents to the compliance team

Have analysts manually decide on a case-by-case basis whether to report

Wait until the incident is fully contained before notifying the compliance team

Define criteria for reportable incidents and include a step in the workflow to notify the compliance team within the required timeframe

A SOC manager is designing a new SOC and needs to define the roles and responsibilities of the team. The team will include analysts, engineers, and a manager. The manager wants to ensure that the SOC can operate effectively during a major incident. Which role assignment is most appropriate?

Engineers are responsible for triaging all alerts

The SOC manager is responsible for performing all incident investigations

The SOC manager acts as the incident commander during major incidents

Analysts are responsible for maintaining the SIEM infrastructure

GIAC Security Operations Manager

Domain 1Objective 2

SOC Design and Planning GSOM Practice Questions (Page 1)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

Questions 1–5

1expert · medium
A SOC manager is selecting a SIEM platform. The organization has a distributed architecture with data centers in multiple regions. The manager needs to ensure that the SIEM can collect and correlate data from all regions while meeting data residency requirements. Which SIEM deployment model is most appropriate?
Select an answer first
2application · medium
A SOC manager is designing a new SOC and wants to ensure that all functional components are covered. The manager has already identified the need for a SIEM, a ticketing system, and a team of analysts. Which additional component is essential to complete the functional picture?
Select an answer first
3application · medium
A healthcare organization is designing a SOC and must comply with HIPAA, which requires safeguarding electronic protected health information (ePHI). The SOC will handle alerts that may contain patient data. Which design choice best aligns the SOC with this compliance obligation?
Select an answer first
4expert · medium
A SOC team is designing its incident response workflow. The organization has a regulatory requirement to report certain incidents within 24 hours. The team wants to ensure that this requirement is met without overwhelming the analysts. Which workflow design is most effective?
Select an answer first
5expert · medium
A SOC manager is designing a new SOC and needs to define the roles and responsibilities of the team. The team will include analysts, engineers, and a manager. The manager wants to ensure that the SOC can operate effectively during a major incident. Which role assignment is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.