In an incident response team, what is the primary responsibility of the incident commander?

To oversee the overall response and make strategic decisions

To communicate with external stakeholders and the media

To contain the incident by isolating affected systems

To perform forensic analysis of affected systems

What is the primary objective of the 'lessons learned' phase in the incident response lifecycle?

To collect forensic evidence for legal proceedings

To restore systems to normal operation

To assign blame for the incident

To identify improvements to processes and plans

What is the purpose of the recovery phase in incident response?

To identify the attacker's identity

To restore affected systems and operations to normal

To contain the incident and prevent spread

Which statement best describes disaster recovery planning as a risk-based process?

It is a technical process that does not require business input.

It is primarily concerned with restoring IT infrastructure before business processes.

It prioritizes recovery of critical systems and data based on business impact.

It focuses on recovering all systems equally to ensure no data loss.

Which activity is part of forensic evidence collection during incident analysis?

Installing security patches on the affected system

Creating a bit-for-bit copy of affected storage media

Rebooting the affected system to clear memory

Deleting suspicious files to prevent further damage

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 3

Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 7)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 31–35

31foundation · easy
In an incident response team, what is the primary responsibility of the incident commander?
Select an answer first
32foundation · easy
What is the primary objective of the 'lessons learned' phase in the incident response lifecycle?
Select an answer first
33foundation · easy
What is the purpose of the recovery phase in incident response?
Select an answer first
34foundation · easy
Which statement best describes disaster recovery planning as a risk-based process?
Select an answer first
35foundation · easy
Which activity is part of forensic evidence collection during incident analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.