A security analyst receives an alert about a possible malware infection on a finance department workstation. The analyst confirms the alert is a true positive and isolates the host from the network. Which next step best aligns with the incident response lifecycle?

Collect a forensic image of the host's memory and disk, then document the chain of custody.

Begin eradication by deleting the malware files and registry keys from the isolated host.

Escalate the incident to law enforcement before performing any further analysis.

Reimage the host immediately to restore it to a known good state and return it to the user.

Why is patch management an important part of vulnerability management?

Patching eliminates the need for vulnerability scanning

Patching ensures that no new vulnerabilities will be discovered

Patching is only required for operating systems

Patching addresses known vulnerabilities that could be exploited by attackers

What is the primary purpose of Security Orchestration, Automation, and Response (SOAR) platforms?

To replace the need for security analysts

To automate and orchestrate security operations processes

To store all security logs indefinitely

A security team is investigating a potential data exfiltration incident. The SIEM shows a large amount of data being transferred from an internal server to an external IP address over a period of several hours. The server is a file share used by multiple departments. The analyst needs to determine if this is legitimate activity. Which action is most effective?

Check the SIEM for similar transfers in the past to establish a baseline.

Block the external IP address immediately to stop the transfer.

Correlate the SIEM data with the server's access logs to identify which user accounts accessed the files during that time.

Contact the external IP's owner to ask about the transfer.

What is the purpose of maintaining a chain of custody for digital evidence?

To encrypt all evidence at rest

To prove the integrity and authenticity of the evidence

To delete evidence after a case is closed

To share evidence with all employees

GIAC Information Security Professional

Domain 2Objective 2

Security Operations GISP Practice Questions (Page 10)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

12concepts

Questions 46–50

46application · medium
A security analyst receives an alert about a possible malware infection on a finance department workstation. The analyst confirms the alert is a true positive and isolates the host from the network. Which next step best aligns with the incident response lifecycle?
Select an answer first
47foundation · easy
Why is patch management an important part of vulnerability management?
Select an answer first
48foundation · easy
What is the primary purpose of Security Orchestration, Automation, and Response (SOAR) platforms?
Select an answer first
49expert · hard
A security team is investigating a potential data exfiltration incident. The SIEM shows a large amount of data being transferred from an internal server to an external IP address over a period of several hours. The server is a file share used by multiple departments. The analyst needs to determine if this is legitimate activity. Which action is most effective?
Select an answer first
50foundation · easy
What is the purpose of maintaining a chain of custody for digital evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.