A SOC manager is designing a shift schedule for a 24/7 SOC with a team of 10 analysts. The SOC has a high volume of alerts during business hours and a lower volume at night. The manager wants to ensure that all alerts are triaged within 15 minutes and that analysts have adequate rest. Which scheduling approach best balances these needs?

Use a rotating shift pattern with more analysts on day shifts and fewer on night shifts, while ensuring at least two analysts are on duty at all times

Use a fixed 8-hour shift pattern with equal staffing on all shifts

Use a 12-hour shift pattern with only one analyst on the night shift

Use an on-call model where analysts are only called in when an alert occurs

A SOC manager needs to report on the SOC's effectiveness to the board. The board is most concerned about how quickly the SOC can contain a serious incident. Which metric best measures this?

Number of alerts triaged per day

What is the primary goal of assessing SOC maturity?

To comply with regulatory requirements

To identify areas for improvement and plan capability enhancements

To determine the exact number of analysts needed

A SOC currently relies on analysts manually checking dashboards and using tribal knowledge to investigate alerts. There is no formal playbook and no documented escalation process. The SOC manager wants to improve maturity. Which capability should be implemented FIRST?

Deploy a SOAR platform to automate all response actions

Purchase a new SIEM with more advanced analytics

Increase the number of analysts on each shift

Document standard operating procedures and an escalation workflow

GIAC Security Operations Manager

Domain 1Objective 2

SOC Design and Planning GSOM Practice Questions (Page 2)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

Questions 6–10

6expert · hard
A SOC manager is designing a shift schedule for a 24/7 SOC with a team of 10 analysts. The SOC has a high volume of alerts during business hours and a lower volume at night. The manager wants to ensure that all alerts are triaged within 15 minutes and that analysts have adequate rest. Which scheduling approach best balances these needs?
Select an answer first
7application · medium
A SOC manager needs to report on the SOC's effectiveness to the board. The board is most concerned about how quickly the SOC can contain a serious incident. Which metric best measures this?
Select an answer first
8foundation · easy
What is the primary goal of assessing SOC maturity?
Select an answer first
9foundation · easy
Which technology is specifically designed to automate response actions in a SOC?
Select an answer first
10application · medium
A SOC currently relies on analysts manually checking dashboards and using tribal knowledge to investigate alerts. There is no formal playbook and no documented escalation process. The SOC manager wants to improve maturity. Which capability should be implemented FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

SOC Design and Planning GSOM Practice Questions (Page 2)

Questions 6–10

A SOC manager needs to report on the SOC's effectiveness to the board. The board is most concerned about how quickly the SOC can contain a serious incident. Which metric best measures this?

What is the primary goal of assessing SOC maturity?

Which technology is specifically designed to automate response actions in a SOC?

A SOC currently relies on analysts manually checking dashboards and using tribal knowledge to investigate alerts. There is no formal playbook and no documented escalation process. The SOC manager wants to improve maturity. Which capability should be implemented FIRST?

Keep studying — SOC Strategy and Architecture