What is the primary goal of the eradication phase?

To preserve evidence for legal proceedings

To restore systems to normal operation

To remove the root cause of the incident from affected systems

To identify the attacker's identity

A security operations center receives two alerts. Alert 1: A low-privilege user account has been locked out after multiple failed login attempts. Alert 2: A domain admin account has successfully logged in from a new location at 3:00 AM. The team has limited staff. Which alert should be investigated first?

Alert 2, because a domain admin account is a high-value target and the login is anomalous.

Both alerts equally, because both are security incidents.

Alert 1, because it is the most recent alert.

Alert 1, because account lockouts are always a sign of an attack.

An employee reports a suspicious email with an attachment they did not open. The security analyst checks the email headers and sees it came from an external domain that closely mimics a vendor's domain. The analyst determines the email is a phishing attempt. What should the analyst do next?

Report the email to the incident response team and block the sender domain.

Wait to see if other employees receive the same email before acting.

Reply to the sender to request more information about the attachment.

Delete the email from the employee's mailbox and take no further action.

During triage, which incident should be prioritized first?

An incident involving a single workstation with no sensitive data

An incident affecting a non-critical system with minimal data exposure

An incident that disrupts a critical business application and exposes customer data

An incident that is easily contained but has no impact on operations

GIAC Critical Controls Certification

Domain 7Objective 1

Incident Response Management GCCC Practice Questions (Page 6)

Part of the Incident Response and Testing domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 26–30

26foundation · easy
What is the primary goal of the eradication phase?
Select an answer first
27application · medium
A company has just experienced a ransomware attack. The incident response team is activated. The CEO wants to know who is in charge of making final decisions during the response. Which role is typically responsible for this?
Select an answer first
28expert · hard
A security operations center receives two alerts. Alert 1: A low-privilege user account has been locked out after multiple failed login attempts. Alert 2: A domain admin account has successfully logged in from a new location at 3:00 AM. The team has limited staff. Which alert should be investigated first?
Select an answer first
29application · medium
An employee reports a suspicious email with an attachment they did not open. The security analyst checks the email headers and sees it came from an external domain that closely mimics a vendor's domain. The analyst determines the email is a phishing attempt. What should the analyst do next?
Select an answer first
30foundation · easy
During triage, which incident should be prioritized first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Incident Response Management GCCC Practice Questions (Page 6)

Questions 26–30

What is the primary goal of the eradication phase?

A company has just experienced a ransomware attack. The incident response team is activated. The CEO wants to know who is in charge of making final decisions during the response. Which role is typically responsible for this?

An employee reports a suspicious email with an attachment they did not open. The security analyst checks the email headers and sees it came from an external domain that closely mimics a vendor's domain. The analyst determines the email is a phishing attempt. What should the analyst do next?

During triage, which incident should be prioritized first?

Keep studying — Incident Response and Testing