GIAC Security Operations Manager
Domain 2Objective 4
Managing Incident Response Execution GSOM Practice Questions (Page 11)
Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)
54questions here
11free pages
12concepts
Questions 51–54
- 51
A company is updating its incident response plan. The plan currently lists the incident response team members but does not specify who has the authority to declare an incident and activate the plan. Which component is missing from the plan?
Select an answer first - 52
Which activity is typically part of a post-incident review?
Select an answer first - 53
During which phase of the incident response lifecycle does the team focus on removing the root cause of the incident from affected systems?
Select an answer first - 54
A company experiences a breach that may involve a nation-state actor. The incident commander is considering involving law enforcement. What is the MOST important factor in this decision?
Select an answer first
Finished these 4 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to GSOM
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.