What is a key component of user awareness training to prevent malware delivery?

Teaching users to share passwords with IT support

Teaching users to install software from any website

Teaching users to verify email sender addresses and avoid clicking unknown links

Teaching users to disable their antivirus software

A company discovers that a worm has infected several servers and is spreading rapidly across the network. The incident response team must contain the worm while preserving evidence for forensic analysis. The worm uses SMB to propagate and modifies files on infected systems. Which action should be taken FIRST?

Run a full antivirus scan on all infected servers.

Power off infected servers to stop the worm immediately.

Delete the modified files to eradicate the worm.

Isolate infected servers by disconnecting them from the network.

A server is infected with malware that is beaconing to an external command-and-control server. The incident response team needs to contain the threat while preserving evidence for forensic analysis. The server is also running a critical production application that cannot be taken offline for more than a few minutes. Which action best balances containment and evidence preservation?

Power off the server immediately to stop the beaconing.

Isolate the server at the network level by blocking its outbound traffic, then capture a memory image before disconnecting it fully.

Disconnect the server from the network and then run a full antivirus scan.

Copy the server's hard drive to a forensic image, then reconnect it to the network.

A security analyst notices that a known malware sample is detected by the antivirus, but a modified version of the same malware with a different hash is not detected. Which limitation of signature-based detection does this illustrate?

Inability to detect malware that requires user interaction.

Inability to detect malware that spreads over the network.

Inability to detect malware that uses encryption.

Inability to detect polymorphic or mutated malware.

An organization's antivirus product failed to detect a new malware variant that is a modified version of a known threat. The modification changes the file's hash and code structure. Which detection method would be most effective for this variant?

Heuristic analysis that examines the file's structure and behavior patterns

Signature-based detection using the original malware's signature

Network-based intrusion detection using known command-and-control signatures

Hash-based blacklisting of the original file

GIAC Critical Controls Certification

Domain 5Objective 4

Malware Defenses GCCC Practice Questions (Page 8)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 36–40

36foundation · easy
What is a key component of user awareness training to prevent malware delivery?
Select an answer first
37expert · hard
A company discovers that a worm has infected several servers and is spreading rapidly across the network. The incident response team must contain the worm while preserving evidence for forensic analysis. The worm uses SMB to propagate and modifies files on infected systems. Which action should be taken FIRST?
Select an answer first
38expert · hard
A server is infected with malware that is beaconing to an external command-and-control server. The incident response team needs to contain the threat while preserving evidence for forensic analysis. The server is also running a critical production application that cannot be taken offline for more than a few minutes. Which action best balances containment and evidence preservation?
Select an answer first
39application · medium
A security analyst notices that a known malware sample is detected by the antivirus, but a modified version of the same malware with a different hash is not detected. Which limitation of signature-based detection does this illustrate?
Select an answer first
40application · medium
An organization's antivirus product failed to detect a new malware variant that is a modified version of a known threat. The modification changes the file's hash and code structure. Which detection method would be most effective for this variant?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Malware Defenses GCCC Practice Questions (Page 8)

Questions 36–40

What is a key component of user awareness training to prevent malware delivery?

A security analyst notices that a known malware sample is detected by the antivirus, but a modified version of the same malware with a different hash is not detected. Which limitation of signature-based detection does this illustrate?

An organization's antivirus product failed to detect a new malware variant that is a modified version of a known threat. The modification changes the file's hash and code structure. Which detection method would be most effective for this variant?

Keep studying — Security Operations and Monitoring