A company wants to ensure it can continue operating during a prolonged disruption, such as a natural disaster. Which activity is the FIRST step in developing a business continuity plan?

Conduct a business impact analysis (BIA) to identify critical functions and their recovery requirements.

Test the continuity plan to ensure it works.

Purchase backup hardware and software for all critical systems.

Train all employees on their roles in the continuity plan.

What is the primary goal of business continuity planning?

To prevent all security incidents from occurring

To ensure the organization's profitability

To replace the incident response plan

To ensure critical business functions can continue during and after a disruption

During an incident, a compromised server is isolated from the network to prevent further spread. The incident response team needs to preserve evidence for potential legal action. What is the BEST next step in the containment and evidence-handling process?

Reboot the server to clear any malicious processes from memory.

Create a forensic image of the server's memory and disk before any further changes.

Apply all available security patches to the server to prevent reinfection.

Restore the server from a clean backup to minimize downtime.

Which of the following is an example of a short-term containment strategy?

Disconnecting the affected system from the network

Conducting a full forensic analysis of the affected system

Implementing a new firewall rule to block malicious traffic

Rebuilding the affected system from a clean backup

GIAC Security Leadership

Domain 3Objective 3

Incident Response and Business Continuity GSLC Practice Questions (Page 3)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

15concepts

15 Concepts in This Objective

Incident Response Lifecycle
Incident Response Team Roles
Incident Classification and Triage
Incident Detection and Reporting
Containment Strategies
Eradication and Recovery
Evidence Handling and Chain of Custody
Communication and Coordination
Post-Incident Review and Lessons Learned
Business Continuity Planning Fundamentals
Business Impact Analysis
Continuity Strategies and Recovery Objectives
Continuity Plan Development and Implementation
Testing and Exercising Continuity Plans
Integration of Incident Response and Business Continuity

Questions 11–15

11application · medium
A company wants to ensure it can continue operating during a prolonged disruption, such as a natural disaster. Which activity is the FIRST step in developing a business continuity plan?
Select an answer first
12foundation · easy
During which phase of the incident response lifecycle are security controls and monitoring tools implemented to improve the organization's ability to detect and respond to future incidents?
Select an answer first
13foundation · easy
What is the primary goal of business continuity planning?
Select an answer first
14application · medium
During an incident, a compromised server is isolated from the network to prevent further spread. The incident response team needs to preserve evidence for potential legal action. What is the BEST next step in the containment and evidence-handling process?
Select an answer first
15foundation · easy
Which of the following is an example of a short-term containment strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.