A security analyst receives an email attachment that is a suspicious executable. The analyst must determine whether it is malicious without risking the production environment. Which approach is the safest and most effective?

Scan the file with the latest antivirus signatures.

Run the executable in a sandboxed environment and observe its behavior.

Inspect the file's strings and metadata without executing it.

Open the file on a non-critical workstation to see what happens.

A company is considering implementing application whitelisting on all workstations. However, the IT team frequently installs new software and updates existing applications. They are concerned that whitelisting will increase administrative overhead and may block legitimate updates. Which approach best addresses this concern while maintaining security?

Rely on antivirus signatures to detect malware instead of whitelisting

Disable whitelisting during software updates and re-enable it after

Use whitelisting only on servers, not workstations

Implement whitelisting with an automated update mechanism that allows signed executables from trusted vendors

A workstation is infected with ransomware that is actively encrypting files. The incident response team needs to stop the spread and preserve evidence. Which sequence of actions should they take first?

Isolate the workstation from the network, then capture a memory image before powering off.

Power off the workstation immediately to stop encryption.

Delete the ransomware files from the workstation.

Run a full antivirus scan on the workstation.

A workstation is infected with ransomware that is actively encrypting files. The incident response team needs to contain the infection while preserving evidence for analysis. Which action should be taken FIRST?

Power off the workstation immediately.

Run a full antivirus scan on the workstation.

Delete the encrypted files to stop the ransomware.

Disconnect the workstation from the network.

A company experienced a ransomware outbreak that exploited a known vulnerability in a third-party application. The vulnerability had a patch available for two months. Which defense layer most likely failed?

Patch and vulnerability management

GIAC Critical Controls Certification

Domain 5Objective 4

Malware Defenses GCCC Practice Questions (Page 9)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 41–45

41application · medium
A security analyst receives an email attachment that is a suspicious executable. The analyst must determine whether it is malicious without risking the production environment. Which approach is the safest and most effective?
Select an answer first
42expert · hard
A company is considering implementing application whitelisting on all workstations. However, the IT team frequently installs new software and updates existing applications. They are concerned that whitelisting will increase administrative overhead and may block legitimate updates. Which approach best addresses this concern while maintaining security?
Select an answer first
43application · medium
A workstation is infected with ransomware that is actively encrypting files. The incident response team needs to stop the spread and preserve evidence. Which sequence of actions should they take first?
Select an answer first
44application · medium
A workstation is infected with ransomware that is actively encrypting files. The incident response team needs to contain the infection while preserving evidence for analysis. Which action should be taken FIRST?
Select an answer first
45application · medium
A company experienced a ransomware outbreak that exploited a known vulnerability in a third-party application. The vulnerability had a patch available for two months. Which defense layer most likely failed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.