A SOC manager is designing a SOC for a utility company that must comply with NERC CIP reliability standards. The SOC will monitor both IT and operational technology (OT) environments. Which of the following functional components are essential to include in the design? (Select all that apply.)

A documented process for coordinating with OT engineers before taking any response action that could affect industrial processes

A single analyst role responsible for both IT and OT alert triage without any specialized training

A public cloud-based log storage solution for all OT logs

A SIEM that can ingest and correlate logs from both IT and OT systems

A dedicated threat intelligence feed focused on industrial control system (ICS) threats

What is the primary reason for defining the scope of a SOC during the design phase?

To clarify which assets, systems, and threats the SOC is responsible for monitoring and defending

To set the salary ranges for SOC staff positions

To decide the physical location of the SOC facility

To determine which security tools will be purchased first

A SOC manager wants to measure the efficiency of the SOC's triage process. Which of the following metrics are appropriate for this purpose? (Select all that apply.)

Percentage of alerts that are false positives

Percentage of alerts escalated to Tier 2

Number of alerts triaged per analyst per shift

Backlog of untriaged alerts at the end of each shift

Time to triage (time from alert creation to first analyst action)

A SOC manager is building a new 24/7 SOC and needs to define roles for a team of eight analysts. The SOC will handle initial triage, escalate confirmed incidents, and maintain detection content. Which staffing structure best aligns with these responsibilities?

A single senior analyst handles all triage and escalation, while junior analysts only monitor dashboards

All analysts perform triage, escalation, and detection engineering equally on every shift

Outsource all triage to an MSSP and keep internal analysts only for detection engineering

Tier 1 analysts perform triage, Tier 2 analysts handle escalated incidents, and a separate detection engineer maintains detection content

How does a SOC typically support compliance obligations?

By storing all data indefinitely

By eliminating the need for external audits

By providing monitoring and reporting that demonstrate adherence to regulatory requirements

By focusing only on technical threats and ignoring regulatory requirements

GIAC Security Operations Manager

Domain 1Objective 2

SOC Design and Planning GSOM Practice Questions (Page 7)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

Questions 31–35

31application · medium · select all that apply
A SOC manager is designing a SOC for a utility company that must comply with NERC CIP reliability standards. The SOC will monitor both IT and operational technology (OT) environments. Which of the following functional components are essential to include in the design? (Select all that apply.)
Select an answer first
32foundation · easy
What is the primary reason for defining the scope of a SOC during the design phase?
Select an answer first
33application · medium · select all that apply
A SOC manager wants to measure the efficiency of the SOC's triage process. Which of the following metrics are appropriate for this purpose? (Select all that apply.)
Select an answer first
34application · medium
A SOC manager is building a new 24/7 SOC and needs to define roles for a team of eight analysts. The SOC will handle initial triage, escalate confirmed incidents, and maintain detection content. Which staffing structure best aligns with these responsibilities?
Select an answer first
35foundation · easy
How does a SOC typically support compliance obligations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.