A security team receives a suspicious email attachment. They need to determine if it is malicious without risking the production network. Which approach should they use?

Execute the attachment in a sandboxed virtual machine with network isolation and observe its behavior.

Compare the file's hash against a public malware database.

Run a full antivirus scan on the email server.

Open the attachment on a spare laptop connected to the corporate network.

A company's endpoint protection platform (EPP) uses signature-based detection and failed to block a new ransomware variant that encrypts files and spreads via SMB. The security team needs to improve detection of such novel threats without waiting for signature updates. Which additional control would most directly address this gap?

Schedule more frequent full disk scans during off-peak hours.

Increase the frequency of signature database updates to every hour.

Deploy a host firewall to block all inbound SMB traffic.

Enable behavioral analysis that monitors for mass file encryption and abnormal SMB scanning activity.

What is the purpose of running a suspicious file in a sandbox?

To permanently delete the file from the system

To improve the performance of the file

To observe its behavior in an isolated environment without risking the production system

A company has a high rate of malware infections from phishing emails. They have implemented technical controls such as email filtering and endpoint protection, but infections continue. The security team wants to reduce the human factor. Which approach is most effective?

Increase the frequency of antivirus signature updates.

Implement a continuous security awareness program with simulated phishing campaigns.

Deploy a next-generation firewall with intrusion prevention.

Block all email attachments at the gateway.

A company has a high rate of malware infections from users clicking on malicious links in emails. The security team wants to implement a control that addresses the root cause. Which control is most directly targeted at this issue?

Deploying an email gateway that blocks known malicious URLs

Implementing endpoint detection and response (EDR) on all workstations

Increasing the frequency of antivirus signature updates

Security awareness training that includes simulated phishing exercises

GIAC Critical Controls Certification

Domain 5Objective 4

Malware Defenses GCCC Practice Questions (Page 10)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 46–50

46application · medium
A security team receives a suspicious email attachment. They need to determine if it is malicious without risking the production network. Which approach should they use?
Select an answer first
47application · medium
A company's endpoint protection platform (EPP) uses signature-based detection and failed to block a new ransomware variant that encrypts files and spreads via SMB. The security team needs to improve detection of such novel threats without waiting for signature updates. Which additional control would most directly address this gap?
Select an answer first
48foundation · easy
What is the purpose of running a suspicious file in a sandbox?
Select an answer first
49expert · hard
A company has a high rate of malware infections from phishing emails. They have implemented technical controls such as email filtering and endpoint protection, but infections continue. The security team wants to reduce the human factor. Which approach is most effective?
Select an answer first
50application · medium
A company has a high rate of malware infections from users clicking on malicious links in emails. The security team wants to implement a control that addresses the root cause. Which control is most directly targeted at this issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.