A SOC manager is planning the lifecycle of a SIEM platform. Which activity is part of the maintenance phase?

Decommissioning the SIEM and migrating to a new tool

Defining the initial use cases for the SIEM

Applying vendor security patches and updating correlation rules

What is the primary purpose of orchestration in a SOAR platform?

To provide a user interface for analysts to view alerts

To store all security logs for long-term retention

To replace the need for a SIEM in the SOC

To coordinate multiple security tools and automate workflows across them

In a SOC workflow, an EDR tool detects a suspicious process on an endpoint and sends an alert to the SIEM. The SIEM correlates this alert with other logs and creates an incident, which is then automatically enriched with threat intelligence. Which statement best describes this data flow?

The EDR directly opens a ticket in the ticketing system without involving the SIEM.

The SIEM sends raw logs to the EDR for analysis.

The SIEM replaces the EDR as the endpoint detection tool.

The EDR sends detection data to the SIEM, which correlates and enriches it to support investigation.

A SOC's SIEM sends an alert to the SOAR platform, which enriches the alert with threat intelligence and then creates a ticket. However, the ticket lacks the enrichment data, so analysts must re-run the enrichment manually. What is the most likely cause and fix?

The threat intelligence feed is down

The SOAR playbook does not include a step to write enrichment results to the ticket

The ticketing system API is not configured

The SIEM is not sending the alert in the correct format

A SOC uses a SIEM that generates alerts, but analysts must manually pivot to the EDR console to investigate endpoints and then manually update the ticket. The manager wants to reduce the time to investigate and respond. What is the most effective way to improve the data flow?

Increase the number of analysts on each shift

Provide analysts with a second monitor for the EDR console

Create a new SIEM dashboard for EDR data

Integrate the SIEM and EDR so that alert context includes endpoint data and deep links

GIAC Security Operations Manager

Domain 1Objective 3

SOC Tools and Technology GSOM Practice Questions (Page 5)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 21–25

21foundation · easy
A SOC manager is planning the lifecycle of a SIEM platform. Which activity is part of the maintenance phase?
Select an answer first
22foundation · easy
What is the primary purpose of orchestration in a SOAR platform?
Select an answer first
23foundation · easy
In a SOC workflow, an EDR tool detects a suspicious process on an endpoint and sends an alert to the SIEM. The SIEM correlates this alert with other logs and creates an incident, which is then automatically enriched with threat intelligence. Which statement best describes this data flow?
Select an answer first
24application · medium
A SOC's SIEM sends an alert to the SOAR platform, which enriches the alert with threat intelligence and then creates a ticket. However, the ticket lacks the enrichment data, so analysts must re-run the enrichment manually. What is the most likely cause and fix?
Select an answer first
25application · medium
A SOC uses a SIEM that generates alerts, but analysts must manually pivot to the EDR console to investigate endpoints and then manually update the ticket. The manager wants to reduce the time to investigate and respond. What is the most effective way to improve the data flow?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.