A security operations manager wants to ensure that all employees know how to report a suspected security incident and understand the importance of doing so quickly. Which training approach is most effective for this goal?

Post a poster in the break room with the incident reporting hotline number

Send a one-time email to all employees describing the incident reporting process

Provide annual role-based training that includes practical exercises on recognizing and reporting incidents

Require all employees to read the incident response plan once

A security operations team is preparing to respond to incidents that may require analyzing network traffic to identify command-and-control communications. Which tool is most essential to have available in the incident response toolkit?

A barcode scanner for asset management

A network protocol analyzer (e.g., Wireshark) and a packet capture appliance

A spreadsheet application for tracking inventory

A word processor for writing incident reports

A security operations manager is defining the scope of incident response preparation for a global company. The company operates in multiple countries with different data protection regulations. The manager must ensure that the incident response plan complies with all applicable regulations while remaining practical. Which approach is most appropriate?

Focus only on the regulations of the company's headquarters country

Create a single plan that applies the strictest regulation to all regions

Develop a core plan with regional addenda that address specific regulatory requirements

Create separate, fully independent plans for each country

A security operations manager is defining the scope of incident response preparation for a mid-sized company. The company has a small IT team and limited budget. Which goal is most appropriate for the preparation phase?

Develop a practical plan that addresses the most likely incident types and can be executed with available resources

Create a comprehensive plan that covers every possible incident scenario in detail

Hire a full-time incident response team

Purchase the most advanced incident response tools available

What is the primary purpose of incident response training and awareness programs?

To replace the need for technical security controls

To ensure that all employees understand their roles and can effectively contribute to incident response efforts

To provide a forum for employees to complain about security policies

To guarantee that no employee ever makes a mistake during an incident

GIAC Security Operations Manager

Domain 2Objective 5

Preparing for Incident Response GSOM Practice Questions (Page 1)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 1–5

1application · medium
A security operations manager wants to ensure that all employees know how to report a suspected security incident and understand the importance of doing so quickly. Which training approach is most effective for this goal?
Select an answer first
2application · medium
A security operations team is preparing to respond to incidents that may require analyzing network traffic to identify command-and-control communications. Which tool is most essential to have available in the incident response toolkit?
Select an answer first
3expert · hard
A security operations manager is defining the scope of incident response preparation for a global company. The company operates in multiple countries with different data protection regulations. The manager must ensure that the incident response plan complies with all applicable regulations while remaining practical. Which approach is most appropriate?
Select an answer first
4application · medium
A security operations manager is defining the scope of incident response preparation for a mid-sized company. The company has a small IT team and limited budget. Which goal is most appropriate for the preparation phase?
Select an answer first
5foundation · easy
What is the primary purpose of incident response training and awareness programs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.