A hospital's IT team detects a ransomware outbreak on the finance department's file server. The malware is actively encrypting files. The incident response team has been activated. The CIO asks for a recommended first action. Which action should the team take first?

Isolate the affected file server from the network to stop the spread.

Begin a full forensic image of the file server for evidence preservation.

Restore the file server from the most recent backup immediately.

Notify the hospital's public relations department to prepare a press release.

A security analyst is triaging alerts. Alert A: A user received a phishing email but did not click the link. Alert B: A server is communicating with a known command-and-control IP address. Which alert should be escalated first?

Both alerts equally, because both are security incidents.

Neither alert, because they are both low priority.

Alert A, because phishing emails are always dangerous.

Alert B, because it indicates an active compromise.

GIAC Critical Controls Certification

Domain 7Objective 1

Incident Response Management GCCC Practice Questions (Page 10)

Part of the Incident Response and Testing domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 46–47

46application · medium
A hospital's IT team detects a ransomware outbreak on the finance department's file server. The malware is actively encrypting files. The incident response team has been activated. The CIO asks for a recommended first action. Which action should the team take first?
Select an answer first
47application · medium
A security analyst is triaging alerts. Alert A: A user received a phishing email but did not click the link. Alert B: A server is communicating with a known command-and-control IP address. Which alert should be escalated first?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Incident Response Management GCCC Practice Questions (Page 10)

Questions 46–47

A hospital's IT team detects a ransomware outbreak on the finance department's file server. The malware is actively encrypting files. The incident response team has been activated. The CIO asks for a recommended first action. Which action should the team take first?

A security analyst is triaging alerts. Alert A: A user received a phishing email but did not click the link. Alert B: A server is communicating with a known command-and-control IP address. Which alert should be escalated first?

Keep studying — Incident Response and Testing