A security operations center (SOC) receives multiple alerts. The alerts include a failed login attempt on a user account, a potential malware download on a workstation, and a large data transfer from a database server. The SOC has limited staff. Which alert should be investigated first?

The failed login attempt, because it may indicate a brute-force attack.

The potential malware download, because malware is always a high priority.

The large data transfer from the database server, because it may indicate data exfiltration.

All alerts equally, because each requires attention.

A financial services company experiences a distributed denial-of-service (DDoS) attack that is overwhelming its public-facing website. At the same time, the security team discovers a potential data breach involving customer data. The company has limited incident response resources. Which incident should be prioritized?

Both incidents equally, because both require immediate attention.

The data breach, because it involves potential exposure of sensitive customer data.

The DDoS attack first, then the data breach, because the DDoS is more visible.

The DDoS attack, because it is actively disrupting customer access.

Which phase of the incident response lifecycle focuses on restoring affected systems to normal operation while confirming the threat has been eliminated?

Containment, Eradication, and Recovery

A company's security team discovers that an attacker has been using a compromised account to access sensitive data. The team has identified the account and the systems involved. They want to prevent further unauthorized access while preserving evidence. Which action should they take?

Delete the account and all associated data to remove the threat.

Disable the account, revoke its access, and isolate affected systems while preserving logs.

Disable the compromised account and change its password.

Monitor the account's activity to gather more information about the attacker's actions.

What is the main purpose of a post-incident review?

To assign blame to individuals who made mistakes

To identify lessons learned and improve future response

To delete all evidence related to the incident

To restore systems to normal operation

GIAC Critical Controls Certification

Domain 7Objective 1

Incident Response Management GCCC Practice Questions (Page 8)

Part of the Incident Response and Testing domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 36–40

36application · medium
A security operations center (SOC) receives multiple alerts. The alerts include a failed login attempt on a user account, a potential malware download on a workstation, and a large data transfer from a database server. The SOC has limited staff. Which alert should be investigated first?
Select an answer first
37expert · hard
A financial services company experiences a distributed denial-of-service (DDoS) attack that is overwhelming its public-facing website. At the same time, the security team discovers a potential data breach involving customer data. The company has limited incident response resources. Which incident should be prioritized?
Select an answer first
38foundation · easy
Which phase of the incident response lifecycle focuses on restoring affected systems to normal operation while confirming the threat has been eliminated?
Select an answer first
39application · medium
A company's security team discovers that an attacker has been using a compromised account to access sensitive data. The team has identified the account and the systems involved. They want to prevent further unauthorized access while preserving evidence. Which action should they take?
Select an answer first
40foundation · easy
What is the main purpose of a post-incident review?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.