Which factor is most important when classifying the severity of an incident?

The skill level of the attacker

The time of day the incident occurred

The potential impact on business operations and data

A security analyst notices unusual outbound network traffic from a server that normally does not communicate externally. The analyst suspects a data exfiltration. The analyst is unsure whether to report it immediately or investigate further. What should the analyst do?

Report the suspicious activity to the incident response team immediately, even if it turns out to be a false positive.

Block the outbound traffic and then report the incident.

Ignore the traffic because it may be a legitimate application update.

Investigate the traffic for several hours to confirm the suspicion before reporting.

GIAC Critical Controls Certification

Domain 7Objective 1

Incident Response Management GCCC Practice Questions (Page 7)

Part of the Incident Response and Testing domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 31–35

31foundation · easy
Which document should be created during post-incident activities to record the timeline and actions taken?
Select an answer first
32foundation · easy
Which factor is most important when classifying the severity of an incident?
Select an answer first
33application · medium
During a security incident, the incident response team discovers that the malware used a zero-day exploit. The team needs to determine the scope of the compromise and preserve evidence for potential legal action. Which team role is primarily responsible for preserving the chain of custody?
Select an answer first
34expert · hard
A security analyst notices unusual outbound network traffic from a server that normally does not communicate externally. The analyst suspects a data exfiltration. The analyst is unsure whether to report it immediately or investigate further. What should the analyst do?
Select an answer first
35application · medium
After an incident, the incident response team holds a review meeting. The team discusses what went well and what could be improved. They decide to update the incident response plan and schedule a tabletop exercise to test the changes. Which phase of the incident response lifecycle does this represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Incident Response Management GCCC Practice Questions (Page 7)

Questions 31–35

Which document should be created during post-incident activities to record the timeline and actions taken?

Which factor is most important when classifying the severity of an incident?

During a security incident, the incident response team discovers that the malware used a zero-day exploit. The team needs to determine the scope of the compromise and preserve evidence for potential legal action. Which team role is primarily responsible for preserving the chain of custody?

A security analyst notices unusual outbound network traffic from a server that normally does not communicate externally. The analyst suspects a data exfiltration. The analyst is unsure whether to report it immediately or investigate further. What should the analyst do?

Keep studying — Incident Response and Testing