A SOC has a SIEM, an EDR, and a ticketing system. The SIEM generates an alert for a suspicious process. The analyst wants to see the process details from the EDR and create a ticket without leaving the SIEM console. Which integration capability is required?

A single sign-on solution for all three tools

A shared database between the SIEM and the EDR

A bidirectional API integration between the SIEM and the EDR, and a SIEM-to-ticketing integration

A manual export from the EDR to the SIEM

A SOC is retiring an old ticketing system and migrating to a new one. The old system contains years of incident history. What should the SOC manager do to preserve the data?

Export the incident data in a structured format and import it into the new system

Print all incident reports and store them in a filing cabinet

Keep the old system running indefinitely

Delete the old system's data after the migration

A SOC manager is selecting a new SIEM platform. The organization has a strict budget, a small team, and a mix of on-premises and cloud workloads. The team needs to correlate logs from both environments and generate compliance reports. Which selection criterion should be prioritized to ensure the SIEM remains effective without overburdening the team?

The ability to ingest logs from both on-premises and cloud sources

The cost per GB of ingested data and the level of vendor support included

The number of pre-built compliance report templates

The number of built-in correlation rules

A SOC manager is reviewing the tool portfolio and finds that a legacy log management system is no longer integrated with the current SIEM and requires manual exports. The vendor has announced end-of-life support. What should the manager do first?

Increase the manual export frequency to keep data current

Plan a migration to a supported tool that integrates with the SIEM

Ask the vendor for a one-time extension of support

Continue using the legacy system until it fails

A SOC's EDR solution is reaching end-of-life. The vendor will stop providing signature updates and technical support in six months. The SOC manager must decide on a replacement. Which approach best aligns with a sound tool lifecycle process?

Rely on the SIEM to compensate for the loss of EDR detection

Begin a formal evaluation and pilot of candidate EDRs, then plan a phased migration before end-of-life

Immediately purchase a new EDR and deploy it without a pilot

Extend the current EDR contract for another year despite the end-of-life

GIAC Security Operations Manager

Domain 1Objective 3

SOC Tools and Technology GSOM Practice Questions (Page 6)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 26–30

26expert · hard
A SOC has a SIEM, an EDR, and a ticketing system. The SIEM generates an alert for a suspicious process. The analyst wants to see the process details from the EDR and create a ticket without leaving the SIEM console. Which integration capability is required?
Select an answer first
27application · medium
A SOC is retiring an old ticketing system and migrating to a new one. The old system contains years of incident history. What should the SOC manager do to preserve the data?
Select an answer first
28application · medium
A SOC manager is selecting a new SIEM platform. The organization has a strict budget, a small team, and a mix of on-premises and cloud workloads. The team needs to correlate logs from both environments and generate compliance reports. Which selection criterion should be prioritized to ensure the SIEM remains effective without overburdening the team?
Select an answer first
29application · medium
A SOC manager is reviewing the tool portfolio and finds that a legacy log management system is no longer integrated with the current SIEM and requires manual exports. The vendor has announced end-of-life support. What should the manager do first?
Select an answer first
30application · medium
A SOC's EDR solution is reaching end-of-life. The vendor will stop providing signature updates and technical support in six months. The SOC manager must decide on a replacement. Which approach best aligns with a sound tool lifecycle process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.