During an incident, the response team discovers that an attacker has established persistence by creating a new local admin account on multiple servers. The team needs to remove the attacker's access while preserving evidence for potential legal action. Which action should the team take first?

Restore the servers from backup without collecting evidence.

Disable the malicious accounts and collect forensic images of the affected servers.

Notify law enforcement before taking any action.

Delete the malicious accounts immediately and then restore from backup.

What is the primary purpose of the Preparation phase in the incident response lifecycle?

To contain the incident and limit damage to affected systems

To identify the root cause of an incident and prevent recurrence

To establish policies, tools, and training needed to handle incidents effectively

To communicate with stakeholders and coordinate response efforts

A company is developing an incident response plan. The team wants to ensure that the plan covers all phases of the incident response lifecycle. Which sequence of phases should the plan follow?

Containment, Eradication, Recovery, Preparation, Detection, Post-Incident Activity.

Preparation, Detection and Analysis, Containment, Eradication, Recovery, Post-Incident Activity.

Detection, Containment, Preparation, Eradication, Recovery, Post-Incident Activity.

Preparation, Containment, Detection, Eradication, Recovery, Post-Incident Activity.

During an incident, the incident response team is activated. The team includes a coordinator, a technical lead, a communications lead, and a legal advisor. The incident involves a malware infection that is spreading. Who is responsible for making the final decision on whether to disconnect affected systems from the network?

The legal advisor, who can assess legal risks.

The incident response coordinator, who has overall responsibility for the response.

The communications lead, who understands the business impact.

The technical lead, who has the expertise to assess the technical impact.

GIAC Critical Controls Certification

Domain 7Objective 1

Incident Response Management GCCC Practice Questions (Page 1)

Part of the Incident Response and Testing domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 1–5

1foundation · easy
Which incident response team role is typically responsible for determining the legal and regulatory obligations during an incident?
Select an answer first
2expert · hard
During an incident, the response team discovers that an attacker has established persistence by creating a new local admin account on multiple servers. The team needs to remove the attacker's access while preserving evidence for potential legal action. Which action should the team take first?
Select an answer first
3foundation · easy
What is the primary purpose of the Preparation phase in the incident response lifecycle?
Select an answer first
4application · medium
A company is developing an incident response plan. The team wants to ensure that the plan covers all phases of the incident response lifecycle. Which sequence of phases should the plan follow?
Select an answer first
5application · medium
During an incident, the incident response team is activated. The team includes a coordinator, a technical lead, a communications lead, and a legal advisor. The incident involves a malware infection that is spreading. Who is responsible for making the final decision on whether to disconnect affected systems from the network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Incident Response Management GCCC Practice Questions (Page 1)

Questions 1–5

Which incident response team role is typically responsible for determining the legal and regulatory obligations during an incident?

During an incident, the response team discovers that an attacker has established persistence by creating a new local admin account on multiple servers. The team needs to remove the attacker's access while preserving evidence for potential legal action. Which action should the team take first?

What is the primary purpose of the Preparation phase in the incident response lifecycle?

A company is developing an incident response plan. The team wants to ensure that the plan covers all phases of the incident response lifecycle. Which sequence of phases should the plan follow?

Keep studying — Incident Response and Testing