A security manager is assigning incident response team roles. The team includes a network engineer, a system administrator, a legal advisor, and a public relations specialist. Which role should be assigned to the public relations specialist?

External communications coordinator

What is the first step in developing an incident response plan?

Hiring external consultants to write the plan

Purchasing incident response software

Conducting a business impact analysis to identify critical assets and priorities

Testing the plan with a full-scale simulation

A security operations manager is assigning incident response roles for a 24/7 operation. The team has limited staff, and some members have multiple skills. Which approach is most effective for assigning roles to ensure coverage and avoid burnout?

Do not assign specific roles; let whoever is available handle the incident

Assign primary and backup roles for each function, and rotate on-call duties among qualified staff

Assign roles only during business hours and rely on external vendors after hours

Assign one person to all roles because they are the most experienced

A security operations manager is drafting an incident response plan for a mid-sized e-commerce company. The plan must clearly define who has authority to make decisions during a major incident, such as whether to take a critical system offline. Which element is most essential to include in the plan to address this requirement?

A schedule for quarterly tabletop exercises

A communication template for notifying customers of a data breach

A list of all available security tools and their default configurations

A detailed escalation matrix that lists decision-making authority for each incident severity level

A regional bank is updating its incident response plan. The security manager must ensure the plan clearly defines who is authorized to make the decision to involve law enforcement during a live ransomware event. Which element of the plan should be updated to address this requirement?

The escalation and notification matrix

The list of approved forensic tools

The training schedule for analysts

GIAC Security Operations Manager

Domain 2Objective 5

Preparing for Incident Response GSOM Practice Questions (Page 7)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 31–35

31application · medium
A security manager is assigning incident response team roles. The team includes a network engineer, a system administrator, a legal advisor, and a public relations specialist. Which role should be assigned to the public relations specialist?
Select an answer first
32foundation · easy
What is the first step in developing an incident response plan?
Select an answer first
33application · medium
A security operations manager is assigning incident response roles for a 24/7 operation. The team has limited staff, and some members have multiple skills. Which approach is most effective for assigning roles to ensure coverage and avoid burnout?
Select an answer first
34application · medium
A security operations manager is drafting an incident response plan for a mid-sized e-commerce company. The plan must clearly define who has authority to make decisions during a major incident, such as whether to take a critical system offline. Which element is most essential to include in the plan to address this requirement?
Select an answer first
35application · medium
A regional bank is updating its incident response plan. The security manager must ensure the plan clearly defines who is authorized to make the decision to involve law enforcement during a live ransomware event. Which element of the plan should be updated to address this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.