A company's incident response team is responding to a malware outbreak. The malware is spreading through a network share. The team has identified the source and affected systems. They need to contain the outbreak while minimizing business disruption. Which containment strategy should they use?

Block access to the network share and isolate affected systems while allowing unaffected systems to continue operating.

Let the malware run its course and then clean up after it stops spreading.

Shut down the file server hosting the network share.

Disconnect all affected systems from the network immediately.

A company has implemented an intrusion detection system (IDS) and a security information and event management (SIEM) system. The SIEM generates an alert for a potential malware infection on a user's workstation. The alert is based on a signature match. What is the most important next step?

Ignore the alert because IDS signatures often produce false positives.

Update the IDS signature database to prevent future alerts.

Verify the alert by investigating the workstation and correlating with other logs.

Immediately disconnect the workstation from the network without further investigation.

A security operations center receives two alerts simultaneously. Alert 1: A single workstation has a failed login attempt. Alert 2: A domain controller shows multiple successful logins from an unknown external IP. The team has limited resources. Which alert should be investigated first?

Alert 2, because it indicates a potential compromise of a critical system.

Alert 1, because failed logins are always a sign of an attack.

Alert 1, because it is the most recent alert.

Alert 2, because external IP addresses are always malicious.

GIAC Critical Controls Certification

Domain 7Objective 1

Incident Response Management GCCC Practice Questions (Page 4)

Part of the Incident Response and Testing domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 16–20

16expert · hard
A company's incident response team is responding to a malware outbreak. The malware is spreading through a network share. The team has identified the source and affected systems. They need to contain the outbreak while minimizing business disruption. Which containment strategy should they use?
Select an answer first
17application · medium
During an incident, the response team identifies that an attacker is using a compromised account to access a database. The team disables the account and blocks the attacker's IP address. Which phase of the incident response lifecycle does this action primarily represent?
Select an answer first
18application · medium
During an incident, a security analyst discovers that an attacker has established persistence by creating a scheduled task on several servers. The analyst removes the scheduled tasks and then restores the servers from clean backups. Which phase of the incident response lifecycle does this action primarily represent?
Select an answer first
19application · medium
A company has implemented an intrusion detection system (IDS) and a security information and event management (SIEM) system. The SIEM generates an alert for a potential malware infection on a user's workstation. The alert is based on a signature match. What is the most important next step?
Select an answer first
20application · medium
A security operations center receives two alerts simultaneously. Alert 1: A single workstation has a failed login attempt. Alert 2: A domain controller shows multiple successful logins from an unknown external IP. The team has limited resources. Which alert should be investigated first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Incident Response Management GCCC Practice Questions (Page 4)

Questions 16–20

A company's incident response team is responding to a malware outbreak. The malware is spreading through a network share. The team has identified the source and affected systems. They need to contain the outbreak while minimizing business disruption. Which containment strategy should they use?

During an incident, the response team identifies that an attacker is using a compromised account to access a database. The team disables the account and blocks the attacker's IP address. Which phase of the incident response lifecycle does this action primarily represent?

A company has implemented an intrusion detection system (IDS) and a security information and event management (SIEM) system. The SIEM generates an alert for a potential malware infection on a user's workstation. The alert is based on a signature match. What is the most important next step?

A security operations center receives two alerts simultaneously. Alert 1: A single workstation has a failed login attempt. Alert 2: A domain controller shows multiple successful logins from an unknown external IP. The team has limited resources. Which alert should be investigated first?

Keep studying — Incident Response and Testing