What is the correct order of the vulnerability management process?

Remediate, assess, identify, prioritize

Prioritize, identify, assess, remediate

Identify, assess, prioritize, remediate

Assess, identify, remediate, prioritize

A SOC wants to implement a SOAR platform to automate alert triage. The team is concerned about the risk of automated actions causing unintended damage. Which approach best mitigates this risk while still improving efficiency?

Start with automated playbooks for low-risk actions and require human approval for high-impact actions.

Automate all response actions to maximize efficiency.

Automate only containment actions, such as blocking IPs, without any review.

Use SOAR only for reporting and do not automate any actions.

A company is updating its incident response plan to align with the business continuity plan. During a major incident, the security team needs to coordinate with the business continuity team to ensure that critical business functions are restored. Which integration is most important?

Ensure the incident response plan includes contact information for the business continuity team and defines escalation paths.

Keep the incident response plan separate from the business continuity plan to avoid confusion.

Focus only on technical containment and leave business recovery to the business continuity team.

Delay business continuity activation until the incident is fully contained.

How does security operations integrate with business continuity planning?

By eliminating the need for backups

By focusing only on IT systems, not business processes

By ensuring that security controls are restored and maintained during a disruption

By preventing all disasters from occurring

A threat intelligence report describes a new ransomware family that uses a specific file name and a unique registry key for persistence. The security team wants to proactively search for these indicators across the environment. Which approach is most effective?

Wait for the SIEM to generate an alert based on the new indicators.

Use the EDR's hunting capabilities to search for the file name and registry key across all endpoints.

Block the file name at the firewall.

Manually check each server for the file name.

GIAC Information Security Professional

Domain 2Objective 2

Security Operations GISP Practice Questions (Page 4)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

12concepts

Questions 16–20

16foundation · easy
What is the correct order of the vulnerability management process?
Select an answer first
17expert · hard
A SOC wants to implement a SOAR platform to automate alert triage. The team is concerned about the risk of automated actions causing unintended damage. Which approach best mitigates this risk while still improving efficiency?
Select an answer first
18application · medium
A company is updating its incident response plan to align with the business continuity plan. During a major incident, the security team needs to coordinate with the business continuity team to ensure that critical business functions are restored. Which integration is most important?
Select an answer first
19foundation · easy
How does security operations integrate with business continuity planning?
Select an answer first
20application · medium
A threat intelligence report describes a new ransomware family that uses a specific file name and a unique registry key for persistence. The security team wants to proactively search for these indicators across the environment. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.