What is the primary purpose of incident triage?

To patch all vulnerable systems

To prioritize alerts based on severity and impact

To permanently delete all alerts

To identify the root cause of an incident

How does a SOAR platform improve incident response efficiency?

By eliminating the need for incident response plans

By increasing the number of false positives

By automating repetitive tasks and coordinating responses across tools

By requiring more analysts to handle each alert

A company has both an IDS and an IPS deployed. The IDS is connected to a SPAN port and the IPS is inline. The security team notices that the IPS is generating many false positives and blocking legitimate traffic. The team wants to reduce false positives while maintaining detection capability. What is the best approach?

Disable the IPS and rely solely on the IDS for detection.

Increase the IPS sensitivity to catch more threats.

Use the IDS alerts to tune the IPS rules, then re-enable blocking for confirmed signatures.

Move the IPS to a SPAN port and the IDS inline.

How does an EDR tool help mitigate threats on an endpoint?

By physically securing the device

By blocking all network traffic to the endpoint

By detecting suspicious behavior and allowing analysts to respond remotely

By replacing the operating system

What is the primary purpose of continuous security monitoring?

To detect anomalies and potential threats in real time

To ensure compliance with all regulations

To eliminate all false positives

To replace the need for incident response

GIAC Information Security Professional

Domain 2Objective 2

Security Operations GISP Practice Questions (Page 3)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

12concepts

Questions 11–15

11foundation · easy
What is the primary purpose of incident triage?
Select an answer first
12foundation · easy
How does a SOAR platform improve incident response efficiency?
Select an answer first
13expert · hard
A company has both an IDS and an IPS deployed. The IDS is connected to a SPAN port and the IPS is inline. The security team notices that the IPS is generating many false positives and blocking legitimate traffic. The team wants to reduce false positives while maintaining detection capability. What is the best approach?
Select an answer first
14foundation · easy
How does an EDR tool help mitigate threats on an endpoint?
Select an answer first
15foundation · easy
What is the primary purpose of continuous security monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.