A SOC uses a SIEM that sends alerts to a ticketing system. Recently, analysts have noticed that some alerts do not create tickets, and others create duplicate tickets. The manager suspects a data flow issue. What is the most likely cause?

The SIEM-to-ticketing integration lacks proper deduplication and error handling

The SIEM's alert rules are misconfigured

The ticketing system's database is full

The analysts are manually creating tickets

A SOC is planning to replace its SIEM. The current SIEM has been customized with hundreds of correlation rules and dashboards. The replacement SIEM has a different query language and data model. The SOC manager must ensure that detection coverage is not lost during the transition. Which approach is most effective?

Recreate all rules from scratch in the new SIEM without referencing the old ones

Migrate all rules in a single weekend cutover

Run the old and new SIEMs in parallel and migrate rules after validating equivalent detection

Decommission the old SIEM immediately after the new one is installed

A SOC uses a SIEM that is reaching its storage capacity. The vendor offers a new version with better compression and indexing. The manager wants to maintain performance and avoid downtime. What should be done first?

Increase the SIEM's log level to capture more data

Immediately upgrade the production SIEM

Review the upgrade path and test the new version in a staging environment

Delete all logs older than 30 days

GIAC Security Operations Manager

Domain 1Objective 3

SOC Tools and Technology GSOM Practice Questions (Page 4)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 16–20

16expert · hard · select all that apply
A SOC manager is designing a new SOC and needs to ensure that the toolset supports the full incident lifecycle: detection, investigation, response, and tracking. The budget is limited, so the manager wants to minimize the number of tools. Which tool categories are essential? Select all that apply.
Select an answer first
17expert · hard
A SOC uses a SIEM that sends alerts to a ticketing system. Recently, analysts have noticed that some alerts do not create tickets, and others create duplicate tickets. The manager suspects a data flow issue. What is the most likely cause?
Select an answer first
18expert · hard
A SOC is planning to replace its SIEM. The current SIEM has been customized with hundreds of correlation rules and dashboards. The replacement SIEM has a different query language and data model. The SOC manager must ensure that detection coverage is not lost during the transition. Which approach is most effective?
Select an answer first
19foundation · easy
A SOC manager wants to automate repetitive incident response actions, such as enriching indicators of compromise and opening tickets, to reduce manual effort. Which category of tool is most appropriate for this task?
Select an answer first
20application · medium
A SOC uses a SIEM that is reaching its storage capacity. The vendor offers a new version with better compression and indexing. The manager wants to maintain performance and avoid downtime. What should be done first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

SOC Tools and Technology GSOM Practice Questions (Page 4)

Questions 16–20

A SOC manager is designing a new SOC and needs to ensure that the toolset supports the full incident lifecycle: detection, investigation, response, and tracking. The budget is limited, so the manager wants to minimize the number of tools. Which tool categories are essential? Select all that apply.

A SOC uses a SIEM that sends alerts to a ticketing system. Recently, analysts have noticed that some alerts do not create tickets, and others create duplicate tickets. The manager suspects a data flow issue. What is the most likely cause?

A SOC manager wants to automate repetitive incident response actions, such as enriching indicators of compromise and opening tickets, to reduce manual effort. Which category of tool is most appropriate for this task?

A SOC uses a SIEM that is reaching its storage capacity. The vendor offers a new version with better compression and indexing. The manager wants to maintain performance and avoid downtime. What should be done first?

Keep studying — SOC Strategy and Architecture