What is application whitelisting?

A list of known malicious applications that are blocked from running

A method to quarantine infected files

A technique to sandbox unknown applications

A list of approved applications that are allowed to run on a system

Why is preserving evidence important during malware incident response?

To support forensic analysis and potential legal action

To prevent the malware from spreading

To speed up the patching process

A company is recovering from a ransomware attack. The ransomware encrypted files on multiple servers and left a ransom note. The incident response team has contained the infection and is now in the eradication and recovery phase. Which action is most important to prevent reinfection?

Identify and remediate the root cause of the initial infection.

Restore files from backups immediately.

Reimage all affected servers from a clean image.

Pay the ransom to decrypt files quickly.

In a layered malware defense, what is the primary purpose of network controls such as firewalls and intrusion prevention systems?

To educate users about safe browsing habits

To patch operating system vulnerabilities

To detect and remove malware already running on a host

To block malicious traffic and prevent malware from reaching endpoints

A security architect is designing a defense-in-depth strategy against malware. The company has a mix of legacy systems that cannot be patched and modern systems that are regularly updated. Which combination of controls provides the most comprehensive protection?

User training and a strong firewall.

Sandboxing all email attachments and blocking all USB devices.

Antivirus signatures and regular patch management.

Network segmentation, application whitelisting, and behavioral monitoring.

GIAC Critical Controls Certification

Domain 5Objective 4

Malware Defenses GCCC Practice Questions (Page 2)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 6–10

6foundation · easy
What is application whitelisting?
Select an answer first
7foundation · easy
Why is preserving evidence important during malware incident response?
Select an answer first
8expert · hard
A company is recovering from a ransomware attack. The ransomware encrypted files on multiple servers and left a ransom note. The incident response team has contained the infection and is now in the eradication and recovery phase. Which action is most important to prevent reinfection?
Select an answer first
9foundation · easy
In a layered malware defense, what is the primary purpose of network controls such as firewalls and intrusion prevention systems?
Select an answer first
10application · medium
A security architect is designing a defense-in-depth strategy against malware. The company has a mix of legacy systems that cannot be patched and modern systems that are regularly updated. Which combination of controls provides the most comprehensive protection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.