After a malware outbreak, the incident response team has contained the affected systems and confirmed the malware has been removed. The team now needs to restore the systems to normal operation. Which action should the team take to ensure a secure recovery?

Reimage the systems from the vendor's recovery media and reconnect them without additional patching.

Restore from the most recent backup and reconnect the systems to the production network immediately.

Reconnect the systems and monitor them for a week to ensure the malware does not return.

Rebuild the systems from a known-good image, apply all security patches, change credentials, and then reconnect to the network.

What is the purpose of maintaining a chain of custody for digital evidence?

To speed up the forensic analysis process

To identify the attacker's identity

To prove that the evidence has not been tampered with

To reduce the cost of evidence storage

Which containment strategy is most appropriate when an infected system must remain online to preserve evidence or maintain business operations?

Isolate the system by disconnecting it from the network

Power off the system immediately

Reimage the system from a known-good backup

Use network segmentation to restrict the system's communication while keeping it running

GIAC Security Operations Manager

Domain 2Objective 4

Managing Incident Response Execution GSOM Practice Questions (Page 7)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

12concepts

Questions 31–35

31application · medium
After a malware outbreak, the incident response team has contained the affected systems and confirmed the malware has been removed. The team now needs to restore the systems to normal operation. Which action should the team take to ensure a secure recovery?
Select an answer first
32foundation · easy
What is the purpose of maintaining a chain of custody for digital evidence?
Select an answer first
33foundation · easy
Which containment strategy is most appropriate when an infected system must remain online to preserve evidence or maintain business operations?
Select an answer first
34foundation · easy
Which metric measures the time between when an incident is first detected and when the response team begins to take action?
Select an answer first
35expert · hard
A security operations manager wants to measure the effectiveness of the incident response team. They have data on time to detect, time to respond, time to contain, and time to recover for several incidents. Which metric would BEST indicate the team's ability to minimize business impact?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

Managing Incident Response Execution GSOM Practice Questions (Page 7)

Questions 31–35

After a malware outbreak, the incident response team has contained the affected systems and confirmed the malware has been removed. The team now needs to restore the systems to normal operation. Which action should the team take to ensure a secure recovery?

What is the purpose of maintaining a chain of custody for digital evidence?

Which containment strategy is most appropriate when an infected system must remain online to preserve evidence or maintain business operations?

Which metric measures the time between when an incident is first detected and when the response team begins to take action?

A security operations manager wants to measure the effectiveness of the incident response team. They have data on time to detect, time to respond, time to contain, and time to recover for several incidents. Which metric would BEST indicate the team's ability to minimize business impact?

Keep studying — Detection and Response Operations