What is a key benefit of integrating incident response and disaster recovery plans?

Reduction in the number of security incidents

Guaranteed prevention of data loss

Improved coordination and faster recovery

Elimination of all security risks

During a shift change at a chemical plant, the operator notices that the HMI is displaying unusual pressure readings that do not match the physical gauges. The plant's OT network has no direct internet connectivity, but the IT network has a link to the corporate office. The incident response team is activated. What should be the FIRST action in the incident response lifecycle?

Detect and analyze the anomaly to confirm whether a security incident is occurring

Contain the potential incident by isolating the affected HMI from the network

Eradicate the threat by reimaging the HMI and restoring from backup

Conduct a lessons-learned review to update the incident response plan

A security analyst at a power utility notices that a historian server is sending large amounts of data to an external IP address during off-hours. The analyst suspects a data exfiltration incident. What should the analyst do FIRST to support forensic analysis while minimizing disruption?

Reboot the server to clear any malicious processes from memory

Immediately disconnect the server from the network to stop the exfiltration

Restore the server from a known-good backup

Take a memory image of the historian server and capture network flows

What is the primary goal of the eradication phase in incident response?

To remove the threat from affected systems

To isolate affected systems from the network

To restore systems to normal operation

To collect evidence for legal proceedings

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 3

Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 5)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 21–25

21foundation · easy
What is a key benefit of integrating incident response and disaster recovery plans?
Select an answer first
22application · medium
During a shift change at a chemical plant, the operator notices that the HMI is displaying unusual pressure readings that do not match the physical gauges. The plant's OT network has no direct internet connectivity, but the IT network has a link to the corporate office. The incident response team is activated. What should be the FIRST action in the incident response lifecycle?
Select an answer first
23application · medium
A security analyst at a power utility notices that a historian server is sending large amounts of data to an external IP address during off-hours. The analyst suspects a data exfiltration incident. What should the analyst do FIRST to support forensic analysis while minimizing disruption?
Select an answer first
24foundation · easy
What is the primary goal of the eradication phase in incident response?
Select an answer first
25foundation · easy
Which recovery site option provides the shortest recovery time objective (RTO) but typically has the highest cost?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.

Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 5)

Questions 21–25

What is a key benefit of integrating incident response and disaster recovery plans?

A security analyst at a power utility notices that a historian server is sending large amounts of data to an external IP address during off-hours. The analyst suspects a data exfiltration incident. What should the analyst do FIRST to support forensic analysis while minimizing disruption?

What is the primary goal of the eradication phase in incident response?

Which recovery site option provides the shortest recovery time objective (RTO) but typically has the highest cost?

Keep studying — Security Management and Response