What is the primary goal of a long-term containment strategy?

To collect evidence for legal proceedings

To permanently remove the threat from the environment

To immediately isolate all affected systems

To maintain business operations while the incident is being resolved

A company has developed a business continuity plan (BCP) that includes procedures for activating the plan and restoring operations. The plan has been approved by management. Which step is MOST important to ensure the plan can be effectively executed during a real disruption?

Storing the plan in a secure location accessible only to the CEO.

Reviewing the plan annually to ensure it is up to date.

Training key personnel on their roles and responsibilities in the plan.

Publishing the plan on the company's public website.

During incident triage, which factor is most important for determining the priority of a reported security incident?

The potential impact on business operations

The name of the person reporting the incident

The time of day the incident was reported

A company has a business continuity plan (BCP) that has been tested through tabletop exercises and has been found to be effective. The company now wants to conduct a more realistic test that involves activating the plan and failing over to the alternate site. However, the company is concerned about the risk of disrupting live operations. Which type of test is MOST appropriate to balance the need for realism with the need to minimize risk?

A parallel test where the alternate site processes live transactions alongside the primary site.

A checklist review where the plan is compared against a generic list of best practices.

A full-scale simulation where the primary site is shut down and all operations are moved to the alternate site.

Another tabletop exercise, as it is the only type of test that can be conducted without risk.

A business impact analysis (BIA) is being conducted for a manufacturing company. Which output is the MOST important for determining continuity strategies?

The total number of IT systems in the organization.

The annual budget for the IT department.

Identification of critical business functions and their maximum tolerable downtime (MTD).

A list of all employees and their contact information.

GIAC Security Leadership

Domain 3Objective 3

Incident Response and Business Continuity GSLC Practice Questions (Page 2)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

15concepts

15 Concepts in This Objective

Incident Response Lifecycle
Incident Response Team Roles
Incident Classification and Triage
Incident Detection and Reporting
Containment Strategies
Eradication and Recovery
Evidence Handling and Chain of Custody
Communication and Coordination
Post-Incident Review and Lessons Learned
Business Continuity Planning Fundamentals
Business Impact Analysis
Continuity Strategies and Recovery Objectives
Continuity Plan Development and Implementation
Testing and Exercising Continuity Plans
Integration of Incident Response and Business Continuity

Questions 6–10

6foundation · easy
What is the primary goal of a long-term containment strategy?
Select an answer first
7application · medium
A company has developed a business continuity plan (BCP) that includes procedures for activating the plan and restoring operations. The plan has been approved by management. Which step is MOST important to ensure the plan can be effectively executed during a real disruption?
Select an answer first
8foundation · easy
During incident triage, which factor is most important for determining the priority of a reported security incident?
Select an answer first
9expert · hard
A company has a business continuity plan (BCP) that has been tested through tabletop exercises and has been found to be effective. The company now wants to conduct a more realistic test that involves activating the plan and failing over to the alternate site. However, the company is concerned about the risk of disrupting live operations. Which type of test is MOST appropriate to balance the need for realism with the need to minimize risk?
Select an answer first
10application · medium
A business impact analysis (BIA) is being conducted for a manufacturing company. Which output is the MOST important for determining continuity strategies?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.