What is an Indicator of Compromise (IoC)?

A vulnerability that has not yet been patched

A security policy that defines acceptable use

A tool used to scan for open ports

A piece of forensic data that suggests a system may have been compromised

During an incident response, a forensic analyst needs to collect evidence from a compromised server. The server is running a critical application that cannot be stopped. The analyst must preserve evidence while minimizing disruption. Which approach balances both requirements?

Power off the server and create a full disk image.

Perform a live acquisition of volatile data and then create a logical image of relevant files.

Wait until the application can be stopped and then perform a full forensic image.

Copy the entire hard drive using a hot-swap bay without shutting down.

Why is disaster recovery planning important for security operations?

It ensures that systems can be restored securely after a disruption

It guarantees that no data will be lost

It eliminates the need for incident response

It focuses only on hardware replacement

What is the first step in digital forensics evidence collection?

Share evidence with stakeholders

Identify and preserve the scene

GIAC Information Security Professional

Domain 2Objective 2

Security Operations GISP Practice Questions (Page 8)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

12concepts

Questions 36–40

36application · medium
A SOC is implementing a new incident response process. The team wants to ensure that alerts are consistently triaged and that critical incidents are escalated to the appropriate personnel. Which role is primarily responsible for the initial assessment and prioritization of alerts?
Select an answer first
37foundation · easy
What is an Indicator of Compromise (IoC)?
Select an answer first
38expert · hard
During an incident response, a forensic analyst needs to collect evidence from a compromised server. The server is running a critical application that cannot be stopped. The analyst must preserve evidence while minimizing disruption. Which approach balances both requirements?
Select an answer first
39foundation · easy
Why is disaster recovery planning important for security operations?
Select an answer first
40foundation · easy
What is the first step in digital forensics evidence collection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.