A SOC manager must select a new SIEM. The organization has a strict data residency requirement: all security logs must remain in the country where the company operates. The company also expects to triple its log volume in the next year. Two vendors are shortlisted: Vendor A offers a cloud SIEM with a data center in the required country but limited storage expansion options. Vendor B offers an on-premises SIEM with unlimited storage but requires significant hardware investment and a longer deployment time. Which choice best balances the constraints?

Vendor A, because it meets data residency and can scale if the vendor expands storage options

Vendor B, because on-premises always guarantees data residency

Vendor B, because the hardware investment is a one-time cost

Vendor A, because cloud SIEMs are always more scalable

A security operations center (SOC) analyst needs to centralize and correlate logs from firewalls, endpoints, and cloud services to detect potential security incidents. Which category of SOC tool is specifically designed for this purpose?

Security Information and Event Management (SIEM)

Endpoint Detection and Response (EDR)

Security Orchestration, Automation, and Response (SOAR)

A SOC receives hundreds of low-severity alerts daily. Analysts spend most of their time verifying whether alerts are true positives. The manager wants to reduce analyst workload without increasing the risk of missing genuine threats. Which approach is most effective?

Increase the severity threshold so only high-severity alerts are generated

Disable the low-severity alert rules entirely

Implement SOAR playbooks that automatically enrich alerts with threat intelligence and close confirmed false positives

Hire more analysts to manually review every alert

A SOC manager wants to automate the response to a common alert type. The SOAR playbook will block the source IP on the firewall and reset the affected user's password. However, the firewall team is concerned about blocking a shared IP address that could affect multiple users. What is the best way to handle this in the playbook?

Automate the IP block but require approval for password reset

Automate both actions for all alerts to ensure rapid response

Automate the password reset but require analyst approval before blocking the IP

Do not automate either action; keep the response manual

A SOC manager wants to reduce the time it takes to contain a common malware outbreak by automatically isolating affected endpoints and blocking the malicious IP address. Which approach best achieves this goal?

Configuring the SIEM to suppress all malware alerts

Increasing the number of analysts to manually respond to each alert

Implementing a SOAR playbook that triggers automated containment actions

Using a ticketing system to track the outbreak manually

GIAC Security Operations Manager

Domain 1Objective 3

SOC Tools and Technology GSOM Practice Questions (Page 1)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 1–5

1expert · hard
A SOC manager must select a new SIEM. The organization has a strict data residency requirement: all security logs must remain in the country where the company operates. The company also expects to triple its log volume in the next year. Two vendors are shortlisted: Vendor A offers a cloud SIEM with a data center in the required country but limited storage expansion options. Vendor B offers an on-premises SIEM with unlimited storage but requires significant hardware investment and a longer deployment time. Which choice best balances the constraints?
Select an answer first
2foundation · easy
A security operations center (SOC) analyst needs to centralize and correlate logs from firewalls, endpoints, and cloud services to detect potential security incidents. Which category of SOC tool is specifically designed for this purpose?
Select an answer first
3application · medium
A SOC receives hundreds of low-severity alerts daily. Analysts spend most of their time verifying whether alerts are true positives. The manager wants to reduce analyst workload without increasing the risk of missing genuine threats. Which approach is most effective?
Select an answer first
4expert · hard
A SOC manager wants to automate the response to a common alert type. The SOAR playbook will block the source IP on the firewall and reset the affected user's password. However, the firewall team is concerned about blocking a shared IP address that could affect multiple users. What is the best way to handle this in the playbook?
Select an answer first
5foundation · easy
A SOC manager wants to reduce the time it takes to contain a common malware outbreak by automatically isolating affected endpoints and blocking the malicious IP address. Which approach best achieves this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.