During an active incident, which information should be communicated to executive leadership?

The names of all affected employees

Detailed technical logs and forensic analysis

A high-level summary of impact and response status

The exact malware signatures detected

Which stakeholder is typically responsible for providing legal guidance during an incident, such as determining if law enforcement should be notified?

Security Operations Center (SOC) Analyst

GIAC Security Essentials

Domain 5Objective 1

Incident Handling & Response GSEC Practice Questions (Page 9)

Part of the Security Operations and Incident Response domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 41–45

41foundation · easy
Which incident handling phase involves restoring affected systems to their normal operational state after the root cause has been removed?
Select an answer first
42application · medium
During an incident, the incident response team discovers that the attacker gained access through a phishing email that bypassed the email filter. The team is now in the lessons learned phase. Which stakeholder should be included in the review to help improve the email filter?
Select an answer first
43foundation · easy
During an active incident, which information should be communicated to executive leadership?
Select an answer first
44foundation · easy
Which stakeholder is typically responsible for providing legal guidance during an incident, such as determining if law enforcement should be notified?
Select an answer first
45foundation · easy
In an incident response team, which role is primarily responsible for coordinating the overall response effort and making final decisions about incident handling?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Incident Handling & Response GSEC Practice Questions (Page 9)

Questions 41–45

Which incident handling phase involves restoring affected systems to their normal operational state after the root cause has been removed?

During an incident, the incident response team discovers that the attacker gained access through a phishing email that bypassed the email filter. The team is now in the lessons learned phase. Which stakeholder should be included in the review to help improve the email filter?

During an active incident, which information should be communicated to executive leadership?

Which stakeholder is typically responsible for providing legal guidance during an incident, such as determining if law enforcement should be notified?

In an incident response team, which role is primarily responsible for coordinating the overall response effort and making final decisions about incident handling?

Keep studying — Security Operations and Incident Response