A global company is deciding between a centralized SOC and a distributed SOC. The company has offices in multiple time zones and wants to reduce the time to respond to incidents. However, the company also wants to maintain local knowledge of regional threats. Which architecture model best meets these needs?

Distributed SOC with regional teams operating independently

Hybrid SOC with regional teams and a central coordination function

Centralized SOC with a single team operating 24/7

Virtual SOC with no physical presence

A SOC manager is preparing a budget for the next fiscal year. The SOC must maintain 24/7 coverage and the team is already at minimum staffing. The manager needs to reduce costs without reducing coverage or laying off staff. Which approach is most appropriate?

Move all analysts to a single day shift and rely on on-call for nights

Eliminate the threat intelligence feed subscription

Reduce the number of SIEM log sources to lower licensing costs

Negotiate with the SIEM vendor for a better licensing tier or use a more cost-effective storage tier for cold logs

A healthcare organization is designing a SOC. It must comply with HIPAA, which requires protecting patient data and reporting certain incidents. The SOC manager needs to ensure the SOC design aligns with these obligations. Which design element is most directly required?

Implementing a SIEM that collects and monitors access logs for systems containing patient data

Creating a public SOC website to share incident information

Focusing SOC operations solely on network perimeter monitoring

Using only open-source security tools to reduce costs

A SOC is being designed for a financial services company. The SOC will need to process a high volume of transactions logs, provide real-time alerting, and retain data for regulatory compliance. Which combination of functional components is essential?

Technology and people only—a SIEM and analysts are enough

People and processes only—analysts and procedures are the core

People, processes, technology, and data—including analysts, incident response procedures, a SIEM platform, and a data retention policy

Technology and data only—a SIEM and a data lake are sufficient

GIAC Security Operations Manager

Domain 1Objective 2

SOC Design and Planning GSOM Practice Questions (Page 4)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

Questions 16–20

16foundation · easy
In a SOC workflow, what is the typical first step in the incident response process?
Select an answer first
17expert · medium
A global company is deciding between a centralized SOC and a distributed SOC. The company has offices in multiple time zones and wants to reduce the time to respond to incidents. However, the company also wants to maintain local knowledge of regional threats. Which architecture model best meets these needs?
Select an answer first
18application · medium
A SOC manager is preparing a budget for the next fiscal year. The SOC must maintain 24/7 coverage and the team is already at minimum staffing. The manager needs to reduce costs without reducing coverage or laying off staff. Which approach is most appropriate?
Select an answer first
19application · medium
A healthcare organization is designing a SOC. It must comply with HIPAA, which requires protecting patient data and reporting certain incidents. The SOC manager needs to ensure the SOC design aligns with these obligations. Which design element is most directly required?
Select an answer first
20application · medium
A SOC is being designed for a financial services company. The SOC will need to process a high volume of transactions logs, provide real-time alerting, and retain data for regulatory compliance. Which combination of functional components is essential?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

SOC Design and Planning GSOM Practice Questions (Page 4)

Questions 16–20

In a SOC workflow, what is the typical first step in the incident response process?

A SOC manager is preparing a budget for the next fiscal year. The SOC must maintain 24/7 coverage and the team is already at minimum staffing. The manager needs to reduce costs without reducing coverage or laying off staff. Which approach is most appropriate?

A healthcare organization is designing a SOC. It must comply with HIPAA, which requires protecting patient data and reporting certain incidents. The SOC manager needs to ensure the SOC design aligns with these obligations. Which design element is most directly required?

A SOC is being designed for a financial services company. The SOC will need to process a high volume of transactions logs, provide real-time alerting, and retain data for regulatory compliance. Which combination of functional components is essential?

Keep studying — SOC Strategy and Architecture