A SOC manager wants to reduce the time to respond to phishing emails reported by users. The team has a SOAR platform and an email gateway. Which automation should be implemented first?

A playbook that deletes the user's entire mailbox

A playbook that sends an acknowledgment email to the user

A playbook that creates a ticket and waits for an analyst

A playbook that automatically quarantines the reported email and enriches the sender details

A SOC manager wants to use SOAR to automate the initial triage of phishing emails. The playbook should quarantine the email, enrich the sender domain, and create a ticket. However, the manager is concerned about false positives causing legitimate emails to be quarantined. What is the best approach to balance automation and risk?

Automate quarantine only for emails from external domains

Automate enrichment and ticket creation, but require analyst approval before quarantine

Do not automate any steps; keep all actions manual

Fully automate all steps including quarantine to maximize efficiency

When a SOC tool reaches end-of-life and the vendor will no longer provide security updates, what is the most appropriate action for the SOC manager?

Plan to retire the tool and migrate to a supported alternative

Increase the number of analysts to manually monitor the tool's logs

Continue using the tool as long as it still functions

Disable all alerts from the tool to avoid false positives

A SOC manager is designing a SOAR playbook for malware containment. The playbook will automatically isolate endpoints and block indicators of compromise (IOCs) on the firewall. The organization has a high number of false positives in its SIEM alerts. The manager must balance response speed with operational risk. Which design is most appropriate?

Require analyst approval for all actions to avoid any risk

Fully automate isolation and IOC blocking for all alerts to achieve the fastest response

Automate IOC blocking but require analyst approval for endpoint isolation

Automate endpoint isolation but require approval for IOC blocking

GIAC Security Operations Manager

Domain 1Objective 3

SOC Tools and Technology GSOM Practice Questions (Page 2)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 6–10

6application · medium
A SOC manager wants to reduce the time to respond to phishing emails reported by users. The team has a SOAR platform and an email gateway. Which automation should be implemented first?
Select an answer first
7application · medium
A SOC manager wants to use SOAR to automate the initial triage of phishing emails. The playbook should quarantine the email, enrich the sender domain, and create a ticket. However, the manager is concerned about false positives causing legitimate emails to be quarantined. What is the best approach to balance automation and risk?
Select an answer first
8foundation · easy
When a SOC tool reaches end-of-life and the vendor will no longer provide security updates, what is the most appropriate action for the SOC manager?
Select an answer first
9foundation · easy
A SOC is evaluating a new SIEM platform. The organization expects to double its log ingestion volume within a year and needs to add new data sources. Which selection criterion is most directly relevant to this requirement?
Select an answer first
10expert · hard
A SOC manager is designing a SOAR playbook for malware containment. The playbook will automatically isolate endpoints and block indicators of compromise (IOCs) on the firewall. The organization has a high number of false positives in its SIEM alerts. The manager must balance response speed with operational risk. Which design is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

SOC Tools and Technology GSOM Practice Questions (Page 2)

Questions 6–10

A SOC manager wants to reduce the time to respond to phishing emails reported by users. The team has a SOAR platform and an email gateway. Which automation should be implemented first?

When a SOC tool reaches end-of-life and the vendor will no longer provide security updates, what is the most appropriate action for the SOC manager?

A SOC is evaluating a new SIEM platform. The organization expects to double its log ingestion volume within a year and needs to add new data sources. Which selection criterion is most directly relevant to this requirement?

Keep studying — SOC Strategy and Architecture