A SOC team is overwhelmed by a high volume of low-fidelity alerts from its SIEM. The manager wants to reduce alert fatigue and improve the team's ability to focus on genuine threats. Which technology addition would most directly address this problem?

Add more SIEM ingestion sources to increase visibility

Deploy a SOAR platform to automate alert triage and enrichment

Purchase additional threat intelligence feeds

Increase the number of analysts on each shift

A multinational company operates in the EU and the US. The EU subsidiary must comply with GDPR, which restricts cross-border data transfers. The company wants to centralize its SOC in the US to reduce costs. Which approach best satisfies both GDPR and the cost goal?

Keep EU data in an EU-based SOC and centralize only non-personal data or detection rules in the US

Centralize all SOC data in the US and rely on standard contractual clauses for transfers

Use a US-based cloud SIEM and claim that the cloud provider is the data controller

Anonymize all EU data before sending it to the US

A SOC team is designing its incident triage workflow. The team wants to ensure that critical incidents are identified quickly and that less severe alerts do not consume excessive analyst time. Which workflow design best achieves this?

Automatically close all alerts that match known false-positive patterns

Use a priority matrix that categorizes alerts based on impact and urgency, with predefined response times

Investigate every alert in the order it arrives

Escalate all alerts to senior analysts for review

A SOC manager is planning to improve the SOC's maturity from an initial level to a defined level. The organization has a moderate budget and the support of executive leadership. The team currently has some documented processes but they are not consistently followed. Which initiative should be prioritized to achieve a defined maturity level?

Implement a formal training and awareness program for all SOC staff

Create a new SOC dashboard for executive reporting

Increase the number of SOC analysts

Purchase a new SIEM platform with advanced analytics

GIAC Security Operations Manager

Domain 1Objective 2

SOC Design and Planning GSOM Practice Questions (Page 8)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

Questions 36–40

36application · medium
A SOC team is overwhelmed by a high volume of low-fidelity alerts from its SIEM. The manager wants to reduce alert fatigue and improve the team's ability to focus on genuine threats. Which technology addition would most directly address this problem?
Select an answer first
37expert · hard
A multinational company operates in the EU and the US. The EU subsidiary must comply with GDPR, which restricts cross-border data transfers. The company wants to centralize its SOC in the US to reduce costs. Which approach best satisfies both GDPR and the cost goal?
Select an answer first
38application · medium
A SOC team is designing its incident triage workflow. The team wants to ensure that critical incidents are identified quickly and that less severe alerts do not consume excessive analyst time. Which workflow design best achieves this?
Select an answer first
39foundation · easy
Which metric is most commonly used to measure the speed of incident detection?
Select an answer first
40expert · medium
A SOC manager is planning to improve the SOC's maturity from an initial level to a defined level. The organization has a moderate budget and the support of executive leadership. The team currently has some documented processes but they are not consistently followed. Which initiative should be prioritized to achieve a defined maturity level?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

SOC Design and Planning GSOM Practice Questions (Page 8)

Questions 36–40

A SOC team is overwhelmed by a high volume of low-fidelity alerts from its SIEM. The manager wants to reduce alert fatigue and improve the team's ability to focus on genuine threats. Which technology addition would most directly address this problem?

A multinational company operates in the EU and the US. The EU subsidiary must comply with GDPR, which restricts cross-border data transfers. The company wants to centralize its SOC in the US to reduce costs. Which approach best satisfies both GDPR and the cost goal?

A SOC team is designing its incident triage workflow. The team wants to ensure that critical incidents are identified quickly and that less severe alerts do not consume excessive analyst time. Which workflow design best achieves this?

Which metric is most commonly used to measure the speed of incident detection?

Keep studying — SOC Strategy and Architecture