What is a key consideration when allocating resources for SOC operations?

Ignoring training to save costs

Ensuring 24/7 coverage requires multiple shifts of analysts

Purchasing the most expensive tools regardless of need

Allocating all resources to a single analyst

A SOC manager is evaluating the team's performance. The SOC has a high number of alerts, but the mean time to respond (MTTR) is low. However, the number of incidents that escalate to the incident response team is also low. The manager suspects that the team is closing alerts too quickly without proper investigation. Which additional metric would best confirm this suspicion?

Percentage of alerts reopened within 24 hours

Number of alerts per analyst per day

A mid-sized company is selecting its initial SOC technology stack. The security team has limited staff and wants to reduce alert fatigue while maintaining visibility across endpoints, network, and cloud. Which technology combination best achieves this with minimal operational overhead?

SIEM with integrated UEBA and SOAR capabilities, plus EDR and cloud-native monitoring

Open-source SIEM only, with no additional tools

Standalone SIEM with raw log storage and manual alert review

Multiple best-of-breed tools for every function with no integration

A SOC manager is evaluating a new SOAR platform. The team currently uses a SIEM for alerting and a ticketing system for case management. The manager wants to reduce the time analysts spend on repetitive tasks. Which SOAR capability is most directly aligned with this goal?

Automated playbooks that perform enrichment and containment actions

Integration with threat intelligence feeds

A new dashboard for visualizing alert trends

GIAC Security Operations Manager

Domain 1Objective 2

SOC Design and Planning GSOM Practice Questions (Page 10)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

Questions 46–50

46foundation · easy
Which SOC role is primarily responsible for tuning detection rules and maintaining the SIEM platform?
Select an answer first
47foundation · easy
What is a key consideration when allocating resources for SOC operations?
Select an answer first
48expert · hard
A SOC manager is evaluating the team's performance. The SOC has a high number of alerts, but the mean time to respond (MTTR) is low. However, the number of incidents that escalate to the incident response team is also low. The manager suspects that the team is closing alerts too quickly without proper investigation. Which additional metric would best confirm this suspicion?
Select an answer first
49application · medium
A mid-sized company is selecting its initial SOC technology stack. The security team has limited staff and wants to reduce alert fatigue while maintaining visibility across endpoints, network, and cloud. Which technology combination best achieves this with minimal operational overhead?
Select an answer first
50expert · medium
A SOC manager is evaluating a new SOAR platform. The team currently uses a SIEM for alerting and a ticketing system for case management. The manager wants to reduce the time analysts spend on repetitive tasks. Which SOAR capability is most directly aligned with this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

SOC Design and Planning GSOM Practice Questions (Page 10)

Questions 46–50

Which SOC role is primarily responsible for tuning detection rules and maintaining the SIEM platform?

What is a key consideration when allocating resources for SOC operations?

A mid-sized company is selecting its initial SOC technology stack. The security team has limited staff and wants to reduce alert fatigue while maintaining visibility across endpoints, network, and cloud. Which technology combination best achieves this with minimal operational overhead?

A SOC manager is evaluating a new SOAR platform. The team currently uses a SIEM for alerting and a ticketing system for case management. The manager wants to reduce the time analysts spend on repetitive tasks. Which SOAR capability is most directly aligned with this goal?

Keep studying — SOC Strategy and Architecture