During a major security incident, the incident response team is overwhelmed with tasks. The incident commander needs to assign a single point of contact for all external communications, including law enforcement and the media. Which role should be assigned this responsibility?

A designated communications liaison

After a phishing campaign successfully compromised several user accounts, the incident response team completed the recovery phase. The CISO asks for a post-incident review. Which activity should be included in the lessons learned phase?

Update the incident response plan based on identified gaps

Conduct a vulnerability scan of the entire network

Delete all logs from the compromised systems

Immediately restore all systems to their pre-incident state

To maintain the chain of custody for digital evidence, which action is most important?

Storing the evidence in a secure server room

Making multiple copies of the evidence

Encrypting the evidence at rest

Documenting every person who handles the evidence

A company has just contained a ransomware attack. The incident response team is preparing a report for senior management. Which information is most important to include in the report?

The names of the employees who were affected by the attack.

The technical details of the ransomware variant and its encryption algorithm.

The IP addresses of the attacker's command-and-control servers.

The timeline of the incident, the impact on business operations, and the actions taken to contain and recover.

GIAC Security Essentials

Domain 5Objective 1

Incident Handling & Response GSEC Practice Questions (Page 3)

Part of the Security Operations and Incident Response domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 11–15

11application · medium
During a major security incident, the incident response team is overwhelmed with tasks. The incident commander needs to assign a single point of contact for all external communications, including law enforcement and the media. Which role should be assigned this responsibility?
Select an answer first
12application · medium
After a phishing campaign successfully compromised several user accounts, the incident response team completed the recovery phase. The CISO asks for a post-incident review. Which activity should be included in the lessons learned phase?
Select an answer first
13foundation · easy
To maintain the chain of custody for digital evidence, which action is most important?
Select an answer first
14application · medium
A company has just contained a ransomware attack. The incident response team is preparing a report for senior management. Which information is most important to include in the report?
Select an answer first
15foundation · easy
Which containment strategy is most appropriate when an infected system must remain operational to support critical business functions, but the malware must not spread to other systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.