What is a key consideration when coordinating with external vendors during incident response?

Sharing all sensitive data without restrictions

Ensuring that vendors have the necessary access and clearances

Avoiding any documentation of vendor activities

Allowing vendors to make final decisions

After containing a malware infection on a server, the incident response team needs to remove the threat and restore the server to normal operation. What is the correct sequence of actions?

Rebuild the server from a known-good image, then restore data from backups

Run antivirus scans and then reconnect the server to the network

Restore data from backups first, then rebuild the server

Disconnect the server and leave it offline indefinitely

An incident is reported that affects a critical business application and is spreading rapidly. According to common prioritization criteria, how should this incident be classified?

Medium severity, medium priority

During an incident, when should legal counsel be consulted regarding regulatory requirements?

Never, as legal issues are handled after the incident

As soon as it is determined that personal data may be involved

Only if the incident results in a lawsuit

Only after the incident is fully contained

GIAC Security Operations Manager

Domain 2Objective 4

Managing Incident Response Execution GSOM Practice Questions (Page 5)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

12concepts

Questions 21–25

21foundation · easy
Which role is responsible for coordinating the overall response effort and making final decisions during an incident?
Select an answer first
22foundation · easy
What is a key consideration when coordinating with external vendors during incident response?
Select an answer first
23application · medium
After containing a malware infection on a server, the incident response team needs to remove the threat and restore the server to normal operation. What is the correct sequence of actions?
Select an answer first
24foundation · easy
An incident is reported that affects a critical business application and is spreading rapidly. According to common prioritization criteria, how should this incident be classified?
Select an answer first
25foundation · easy
During an incident, when should legal counsel be consulted regarding regulatory requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.