During a major security incident, the incident commander needs to provide a status update to the executive leadership team. Which communication should the incident commander provide?

A summary of the incident's impact, current response actions, and expected timeline for resolution.

A detailed technical report of the malware's behavior and the indicators of compromise.

A list of all affected IP addresses and the specific commands used by the attacker.

A request for additional funding to purchase new security tools.

Which of the following is a key requirement for proper evidence handling during an incident?

Documenting every person who accesses the evidence

Deleting evidence after the incident is closed

Sharing evidence with all team members

Storing evidence on the affected system

What is the primary purpose of data breach notification laws?

To require organizations to inform affected individuals and regulators about a breach

To provide a legal defense for organizations that suffer a breach

To allow organizations to keep breaches confidential

To prevent all data breaches from occurring

When should an organization consider coordinating with law enforcement during an incident?

Only after the incident is fully resolved

When the incident may involve criminal activity

Never, to avoid legal complications

Only if the incident is reported in the media

GIAC Security Operations Manager

Domain 2Objective 4

Managing Incident Response Execution GSOM Practice Questions (Page 6)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

12concepts

Questions 26–30

26application · medium
During a major security incident, the incident commander needs to provide a status update to the executive leadership team. Which communication should the incident commander provide?
Select an answer first
27foundation · easy
Which of the following is a key requirement for proper evidence handling during an incident?
Select an answer first
28foundation · easy
What is the primary purpose of data breach notification laws?
Select an answer first
29foundation · easy
When should an organization consider coordinating with law enforcement during an incident?
Select an answer first
30foundation · easy
Which component of an incident response plan defines who has the authority to make decisions during an incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.