A SOC manager is selecting a new SIEM for a 5,000-employee organization that expects to double its log sources over the next two years. The security team has limited staff and wants to minimize the number of tools analysts must learn. Which selection criterion should be prioritized to address the growth and staffing constraints?

Number of built-in compliance report templates

Scalability and integration with existing security tools

Vendor's market share in the SIEM industry

A SOC manager is planning to upgrade the SIEM to a new major version. The upgrade will change the data ingestion format and requires reconfiguring all log sources. The SOC has a 24/7 operation and cannot afford downtime. What is the best approach?

Delay the upgrade until the next scheduled maintenance window

Upgrade the production SIEM during a low-activity weekend

Upgrade the SIEM and reconfigure all log sources at once

Deploy the new version in parallel, migrate log sources gradually, and cut over when stable

A SOC manager is reviewing the tool portfolio and finds that the SIEM is ingesting logs from a legacy system that is being decommissioned. The SIEM's storage costs are rising. The manager must balance the need to retain historical data for compliance with the need to control costs. Which action is most appropriate?

Increase the SIEM's storage capacity to accommodate the data

Keep ingesting logs from the legacy system until it is fully decommissioned, then archive the data to lower-cost storage

Reduce the log retention period for all sources to lower storage costs

Stop ingesting logs from the legacy system immediately and delete all historical data

A SOC uses a SIEM and a ticketing system. Analysts want to see the raw log data behind a SIEM alert directly from the ticket. Which integration approach supports this?

Embed a deep link in the ticket that opens the SIEM query with the relevant event context

Copy the alert summary into the ticket description

Email the raw logs to the analyst

Attach a screenshot of the SIEM dashboard to the ticket

GIAC Security Operations Manager

Domain 1Objective 3

SOC Tools and Technology GSOM Practice Questions (Page 3)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 11–15

11application · medium
A SOC manager is selecting a new SIEM for a 5,000-employee organization that expects to double its log sources over the next two years. The security team has limited staff and wants to minimize the number of tools analysts must learn. Which selection criterion should be prioritized to address the growth and staffing constraints?
Select an answer first
12expert · hard
A SOC manager is planning to upgrade the SIEM to a new major version. The upgrade will change the data ingestion format and requires reconfiguring all log sources. The SOC has a 24/7 operation and cannot afford downtime. What is the best approach?
Select an answer first
13foundation · easy
During a SOC tool selection, the team compares two EDR products. One has a lower license fee but requires significant custom integration with the existing SIEM, while the other has a higher license fee but includes out-of-the-box integration. Which criterion is the team weighing when considering the integration effort?
Select an answer first
14expert · hard
A SOC manager is reviewing the tool portfolio and finds that the SIEM is ingesting logs from a legacy system that is being decommissioned. The SIEM's storage costs are rising. The manager must balance the need to retain historical data for compliance with the need to control costs. Which action is most appropriate?
Select an answer first
15application · medium
A SOC uses a SIEM and a ticketing system. Analysts want to see the raw log data behind a SIEM alert directly from the ticket. Which integration approach supports this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

SOC Tools and Technology GSOM Practice Questions (Page 3)

Questions 11–15

A SOC manager is planning to upgrade the SIEM to a new major version. The upgrade will change the data ingestion format and requires reconfiguring all log sources. The SOC has a 24/7 operation and cannot afford downtime. What is the best approach?

A SOC uses a SIEM and a ticketing system. Analysts want to see the raw log data behind a SIEM alert directly from the ticket. Which integration approach supports this?

Keep studying — SOC Strategy and Architecture