Which statement best defines the primary purpose of a SOC's mission statement?

To document the daily shift schedule and staffing rotations for SOC analysts

To specify the exact metrics and KPIs used to measure SOC performance

To list the specific security tools and technologies the SOC will deploy

To describe the SOC's role in protecting the organization's assets and supporting business objectives

A SOC manager must decide between building an in-house SOC and outsourcing to a managed security service provider (MSSP). The organization has a limited budget but requires 24/7 coverage and has a small internal security team. The manager also wants to retain control over incident response. Which approach best balances cost, coverage, and control?

Use a co-managed model where the MSSP handles everything and the internal team is only informed of incidents

Build a fully in-house SOC with 24/7 staffing

Use a hybrid model: MSSP for 24/7 monitoring and alerting, internal team for incident response

Fully outsource to an MSSP and rely on them for all security operations

A global bank is designing a SOC. It must comply with data residency regulations that require customer data to remain in specific countries. The bank also wants to reduce costs by consolidating tools. Which architecture model best satisfies both constraints?

A fully distributed model with each regional SOC operating completely independently

A virtual SOC using a single cloud provider with data stored in one region

A hybrid model with regional SOCs that process and store data locally, but share detection rules and threat intelligence centrally

A single centralized SOC in one country that collects all data globally

In the context of SOC functional components, what does 'processes' refer to?

The data sources and logs collected from the network

The hardware and software used for monitoring

The procedures and workflows for detecting and responding to incidents

The analysts and engineers who staff the SOC

GIAC Security Operations Manager

Domain 1Objective 2

SOC Design and Planning GSOM Practice Questions (Page 11)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

Questions 51–55

51foundation · easy
Which statement best defines the primary purpose of a SOC's mission statement?
Select an answer first
52expert · medium
A SOC manager must decide between building an in-house SOC and outsourcing to a managed security service provider (MSSP). The organization has a limited budget but requires 24/7 coverage and has a small internal security team. The manager also wants to retain control over incident response. Which approach best balances cost, coverage, and control?
Select an answer first
53foundation · easy
Which SOC maturity level is characterized by ad-hoc processes and minimal formalization?
Select an answer first
54expert · hard
A global bank is designing a SOC. It must comply with data residency regulations that require customer data to remain in specific countries. The bank also wants to reduce costs by consolidating tools. Which architecture model best satisfies both constraints?
Select an answer first
55foundation · easy
In the context of SOC functional components, what does 'processes' refer to?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

SOC Design and Planning GSOM Practice Questions (Page 11)

Questions 51–55

Which statement best defines the primary purpose of a SOC's mission statement?

Which SOC maturity level is characterized by ad-hoc processes and minimal formalization?

A global bank is designing a SOC. It must comply with data residency regulations that require customer data to remain in specific countries. The bank also wants to reduce costs by consolidating tools. Which architecture model best satisfies both constraints?

In the context of SOC functional components, what does 'processes' refer to?

Keep studying — SOC Strategy and Architecture