An organization is updating its incident response plan. The plan must ensure that during a major incident, the right people make decisions and communication flows effectively. What is the MOST important component to include?

A detailed budget for incident response activities

A list of all employees' personal contact information

A detailed list of all software and hardware assets

Defined roles, responsibilities, and escalation paths

During a prolonged incident, the incident commander must provide regular updates to multiple stakeholders, including executives, legal counsel, and the technical response team. The stakeholders have different information needs. Which communication strategy is most effective?

Hold a single daily meeting with all stakeholders to discuss the incident.

Provide tailored updates to each stakeholder group, with the appropriate level of detail and frequency.

Send the same detailed technical update to all stakeholders to ensure everyone has the same information.

Update only the executives and let them disseminate information to other stakeholders.

What is the primary objective of the recovery phase in incident response?

To preserve evidence for legal proceedings

To prevent the incident from spreading

To identify the root cause of the incident

To restore affected systems to normal operation

GIAC Security Operations Manager

Domain 2Objective 4

Managing Incident Response Execution GSOM Practice Questions (Page 4)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

12concepts

Questions 16–20

16expert · hard
An organization is updating its incident response plan. The plan must ensure that during a major incident, the right people make decisions and communication flows effectively. What is the MOST important component to include?
Select an answer first
17expert · hard
During a prolonged incident, the incident commander must provide regular updates to multiple stakeholders, including executives, legal counsel, and the technical response team. The stakeholders have different information needs. Which communication strategy is most effective?
Select an answer first
18application · medium
A security operations manager wants to evaluate the effectiveness of the incident response team's detection capabilities. Which metric is most appropriate for this purpose?
Select an answer first
19foundation · easy
What is the primary objective of the recovery phase in incident response?
Select an answer first
20foundation · easy
Which metric is most directly related to the goal of minimizing business disruption?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

Managing Incident Response Execution GSOM Practice Questions (Page 4)

Questions 16–20

An organization is updating its incident response plan. The plan must ensure that during a major incident, the right people make decisions and communication flows effectively. What is the MOST important component to include?

During a prolonged incident, the incident commander must provide regular updates to multiple stakeholders, including executives, legal counsel, and the technical response team. The stakeholders have different information needs. Which communication strategy is most effective?

A security operations manager wants to evaluate the effectiveness of the incident response team's detection capabilities. Which metric is most appropriate for this purpose?

What is the primary objective of the recovery phase in incident response?

Which metric is most directly related to the goal of minimizing business disruption?

Keep studying — Detection and Response Operations