Online Access Free GSOM Practice Test

What is the primary goal of the containment phase in incident response?
Response:

• A.To permanently fix all system vulnerabilities
• B.To limit the extent of the damage and isolate affected systems
• C.To identify the attacker,s identity and motive
• D.To restore all systems to operational status

In the incident response cycle, which method is most effective for identifying the root cause of an incident?
Response:

• A.Solely relying on automated alerts to determine the cause
• B.Conducting a thorough investigation of the incident, including a timeline analysis
• C.Ignoring low-severity incidents to focus on high-severity ones
• D.Depending exclusively on external consultants for every incident investigation

Effective data collection and enrichment in SOC operations should:
(Choose two)
Response:

• A.Be tailored to support specific monitoring objectives
• B.Prioritize data sources based on their relevance to organizational use cases
• C.Be indiscriminate to ensure no data is missed
• D.Ignore the context provided by existing security frameworks

Why is prioritization important in data source assessment for SOC monitoring?
Response:

• A.To facilitate the rapid processing of less important data
• B.To ensure that critical data sources are monitored more closely
• C.To enable the collection of all available data without discrimination
• D.To focus resources on analyzing high-volume data sources only

What role does the preparation phase play in the overall SOC operations?
Response:

• A.It ensures SOC operations are only reactive, not proactive
• B.It mandates external intervention for all incident responses
• C.It isolates incident response from the rest of SOC operations
• D.It integrates incident response within broader SOC monitoring and analysis activities