GSOM by GIAC Actual Free Exam Q&As

Question 1

In the context of incident response, why is it important to have predefined escalation paths?
Response:

A. To focus solely on high-severity incidents B. To ensure timely and appropriate response actions are taken C. To create unnecessary bureaucracy and delay responses D. To involve as many people as possible in every incident

Discussion 0

Correct Answer: B Vote an answer

Question 2

Which metric is essential for measuring the effectiveness of SOC''s incident response capabilities?
Response:

A. The total annual budget of the SOC B. The number of coffee cups consumed by the team C. Mean Time to Detect (MTTD) incidents D. The number of staff parties held annually

Discussion 0

Correct Answer: C Vote an answer

Question 3

Which element is essential to include in an incident response plan?
Response:

A. A clause that eliminates the need for regular plan testing B. Instructions to conceal security breaches from stakeholders C. A policy that exempts senior management from compliance D. Defined roles and responsibilities for the response team

Discussion 0

Correct Answer: D Vote an answer

Question 4

What role does automation play in SOC tool effectiveness?
Response:

A. It is only used for communication purposes within the SOC B. Automation should be avoided as it can lead to missed threats C. It entirely replaces the need for human analysts D. It increases efficiency by automating repetitive and low-level tasks

Discussion 0

Correct Answer: D Vote an answer

Question 5

Why is it crucial to include all relevant stakeholders in incident response planning?
Response:

A. To foster a comprehensive approach that covers technical and business aspects B. To guarantee that the plan focuses on IT systems exclusively C. To ensure that the plan is overly complicated and difficult to execute D. To avoid testing the plan to save time and resources

Discussion 0

Correct Answer: A Vote an answer

Question 6

When integrating SOC within an organization, it is critical to:
(Choose two)
Response:

A. Establish clear communication channels between the SOC and other departments B. Operate the SOC in complete isolation to maintain security focus C. Ignore feedback from non-security departments to avoid diluting the security focus D. Align SOC processes with the organization,s IT infrastructure and business operations

Discussion 0

Correct Answer: A,D Vote an answer

Question 7

What are key components to ensure the success of the detection and analysis phase in incident response?
(Select all that apply)
Response:

A. Utilizing a single monitoring tool to simplify the process B. Integrating threat intelligence to inform the analysis C. Maintaining up-to-date baselines of normal network behavior D. Collaborating across departments for comprehensive situational awareness

Discussion 0

Correct Answer: B,C,D Vote an answer

GIAC Security Operations Manager - GSOM Exam Practice Test