A company experiences a breach that may involve organized crime. The incident commander is considering whether to involve law enforcement. What should be the FIRST consideration?

Whether the breach notification law requires reporting to law enforcement

Whether the company's cyber insurance policy covers legal fees

Whether the public relations team can handle the media attention

Whether the incident response team has enough staff to support an investigation

What is the primary responsibility of the Communications Lead during an incident response?

To manage all internal and external communications about the incident

To document all actions taken during the response

To perform forensic analysis of affected systems

To make final decisions on containment strategies

A company is responding to a ransomware incident that has affected its operations. The company is considering whether to involve law enforcement. The incident response team has collected evidence, but the company is concerned about the potential for the incident to become public and the impact on its reputation. Which factor should the company consider when deciding whether to involve law enforcement?

The company's desire to keep the incident confidential to protect its reputation.

The potential for law enforcement to assist in decrypting the ransomware.

The legal requirement to report the incident to law enforcement, if applicable.

The risk that law enforcement will seize the company's systems and disrupt operations.

During a prolonged incident, the incident commander must provide regular updates to executives, legal counsel, and the technical team. The updates must be timely but not overwhelm any audience. What is the BEST communication strategy?

Only update the technical team and let them inform others

Send tailored updates at defined intervals: high-level status to executives, legal implications to counsel, and technical details to IT

Post updates on a public website to ensure transparency

Send a single detailed technical report to all stakeholders at the end of each day

GIAC Security Operations Manager

Domain 2Objective 4

Managing Incident Response Execution GSOM Practice Questions (Page 8)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

12concepts

Questions 36–40

36application · medium
A company experiences a breach that may involve organized crime. The incident commander is considering whether to involve law enforcement. What should be the FIRST consideration?
Select an answer first
37application · medium
During a large-scale incident, the incident commander is overwhelmed with tasks. Which role should be assigned to handle communication with external stakeholders?
Select an answer first
38foundation · easy
What is the primary responsibility of the Communications Lead during an incident response?
Select an answer first
39expert · hard
A company is responding to a ransomware incident that has affected its operations. The company is considering whether to involve law enforcement. The incident response team has collected evidence, but the company is concerned about the potential for the incident to become public and the impact on its reputation. Which factor should the company consider when deciding whether to involve law enforcement?
Select an answer first
40expert · hard
During a prolonged incident, the incident commander must provide regular updates to executives, legal counsel, and the technical team. The updates must be timely but not overwhelm any audience. What is the BEST communication strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

Managing Incident Response Execution GSOM Practice Questions (Page 8)

Questions 36–40

A company experiences a breach that may involve organized crime. The incident commander is considering whether to involve law enforcement. What should be the FIRST consideration?

During a large-scale incident, the incident commander is overwhelmed with tasks. Which role should be assigned to handle communication with external stakeholders?

What is the primary responsibility of the Communications Lead during an incident response?

During a prolonged incident, the incident commander must provide regular updates to executives, legal counsel, and the technical team. The updates must be timely but not overwhelm any audience. What is the BEST communication strategy?

Keep studying — Detection and Response Operations