During an incident, the incident response team needs to collect memory from a compromised server. The team discovers that the memory acquisition tool is not installed on the server and the installation media is not available. Which preparation step would have prevented this problem?

Documenting the incident response plan in a wiki

Maintaining a jump kit with pre-configured forensic tools and installation media

Assigning a single incident commander

A multinational company operates in a country with strict data residency laws. The incident response policy states that all incident data must be stored within the country. During a major incident, the team wants to use a cloud-based forensic analysis service that stores data in another country. What is the best course of action?

Select a forensic service that has a data center within the required country and update the plan to include this approved vendor

Refuse to use the cloud service and conduct all analysis on-premises

Use the cloud service but ensure that only metadata is uploaded and the full evidence remains on-premises

Update the policy to allow data transfer to the cloud service's location

A security operations manager is defining the scope of the incident response program for a healthcare organization. The program must comply with HIPAA and cover all systems that handle protected health information (PHI). Which action best aligns the program's scope with this requirement?

Exclude cloud-based systems because they are managed by the vendor

Include all systems that store, process, or transmit PHI in the incident response plan

Focus the plan on physical security incidents only

Limit the plan to only the electronic health record (EHR) system

Which of the following is an example of an incident response awareness activity for non-technical staff?

Instructing employees on how to configure firewalls

Teaching employees how to recognize and report suspicious emails

Teaching employees to write malware signatures

Training employees to perform forensic disk imaging

GIAC Security Operations Manager

Domain 2Objective 5

Preparing for Incident Response GSOM Practice Questions (Page 4)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 16–20

16application · medium
During an incident, the incident response team needs to collect memory from a compromised server. The team discovers that the memory acquisition tool is not installed on the server and the installation media is not available. Which preparation step would have prevented this problem?
Select an answer first
17application · medium
A security manager wants to validate that the incident response plan works under realistic conditions, including the actual tools and systems that would be used. Which testing method is most appropriate?
Select an answer first
18expert · hard
A multinational company operates in a country with strict data residency laws. The incident response policy states that all incident data must be stored within the country. During a major incident, the team wants to use a cloud-based forensic analysis service that stores data in another country. What is the best course of action?
Select an answer first
19application · medium
A security operations manager is defining the scope of the incident response program for a healthcare organization. The program must comply with HIPAA and cover all systems that handle protected health information (PHI). Which action best aligns the program's scope with this requirement?
Select an answer first
20foundation · easy
Which of the following is an example of an incident response awareness activity for non-technical staff?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

Preparing for Incident Response GSOM Practice Questions (Page 4)

Questions 16–20

During an incident, the incident response team needs to collect memory from a compromised server. The team discovers that the memory acquisition tool is not installed on the server and the installation media is not available. Which preparation step would have prevented this problem?

A security manager wants to validate that the incident response plan works under realistic conditions, including the actual tools and systems that would be used. Which testing method is most appropriate?

A security operations manager is defining the scope of the incident response program for a healthcare organization. The program must comply with HIPAA and cover all systems that handle protected health information (PHI). Which action best aligns the program's scope with this requirement?

Which of the following is an example of an incident response awareness activity for non-technical staff?

Keep studying — Detection and Response Operations