Which of the following is an essential element of an incident response plan?

Detailed procedures for detecting, analyzing, containing, eradicating, and recovering from incidents

A list of all employees' personal phone numbers

The complete source code of all organizational applications

A guarantee that no data will be lost during an incident

What is a critical resource that should be available to the incident response team during an incident?

Access to the CEO's personal email account

Up-to-date contact information for team members and key stakeholders

A backup of all employee personal files

A list of all employee salaries

A security operations manager is preparing for incidents that may require specialized forensic analysis beyond the team's capabilities. The organization wants to ensure that external expertise is available quickly when needed. Which action is most appropriate to take during the preparation phase?

Wait until an incident occurs and then search for a vendor

Train all internal staff to become forensic experts

Purchase additional forensic software without a support contract

Establish a retainer agreement with a digital forensics firm

Which of the following is an example of a tool commonly used to support incident response operations?

Security information and event management (SIEM) system

GIAC Security Operations Manager

Domain 2Objective 5

Preparing for Incident Response GSOM Practice Questions (Page 8)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 36–40

36foundation · easy
Which of the following is an essential element of an incident response plan?
Select an answer first
37foundation · easy
Which role is typically responsible for leading the overall incident response effort and making final decisions during a major incident?
Select an answer first
38foundation · easy
What is a critical resource that should be available to the incident response team during an incident?
Select an answer first
39application · medium
A security operations manager is preparing for incidents that may require specialized forensic analysis beyond the team's capabilities. The organization wants to ensure that external expertise is available quickly when needed. Which action is most appropriate to take during the preparation phase?
Select an answer first
40foundation · easy
Which of the following is an example of a tool commonly used to support incident response operations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.