GIAC Security Operations Manager 認定 GSOM 試験問題:

1. The incident response cycle typically begins with which of the following phases?
Response:

A) Recovery
B) Identification
C) Eradication
D) Preparation

2. When integrating SOC within an organization, it is critical to:
(Choose two)
Response:

A) Establish clear communication channels between the SOC and other departments
B) Align SOC processes with the organization,s IT infrastructure and business operations
C) Ignore feedback from non-security departments to avoid diluting the security focus
D) Operate the SOC in complete isolation to maintain security focus

3. Select the statements that accurately describe the planning of data collection in SOC monitoring:
(Choose two)
Response:

A) It should involve stakeholders from different organizational departments.
B) It requires disregarding the data privacy regulations.
C) It should consider both internal and external data sources.
D) It must focus solely on data that can be collected quickly.

4. What is the primary goal of the containment phase in incident response?
Response:

A) To limit the extent of the damage and isolate affected systems
B) To identify the attacker,s identity and motive
C) To restore all systems to operational status
D) To permanently fix all system vulnerabilities

5. Which of the following is considered an active defense technique?
Response:

A) Outsourcing all security operations with no internal oversight
B) Ignoring suspicious activity to avoid alerting potential adversaries
C) Exclusively relying on antivirus software for threat detection
D) Deploying honeypots to detect and analyze attacks

質問と回答：