A company's endpoint detection team needs to collect process creation, network connections, and file creation events from Windows workstations. They want to minimize the performance impact on user machines and avoid sending raw event logs to the central SIEM. Which approach best meets these requirements?

Install an agent that filters events locally and forwards only those matching detection rules

Enable PowerShell script block logging and send those logs to the SIEM

Configure Windows Event Forwarding to send all Security and Sysmon logs to a central collector

Deploy a network tap to capture traffic and infer endpoint activity from network flows

A detection team wants to detect a new malware variant that is polymorphic and changes its file hash each time it runs. They have observed that the malware always creates a mutex with a specific name and writes to a specific registry key. Which analytical technique is most effective?

Use file hash blacklisting to block the malware

Baseline normal mutex creation and flag any new mutex

Use anomaly detection on file creation frequency

Correlate the specific mutex name and registry key write as indicators of compromise

An analyst is investigating a possible data exfiltration from a Windows endpoint. The analyst suspects that a process read a sensitive file and then sent data over the network. Which combination of endpoint data sources would provide the strongest evidence?

File system audit logs and network connection logs

Process creation logs and registry event logs

Authentication logs and DNS logs

A detection rule for 'suspicious scheduled task creation' is alerting on legitimate IT automation tasks. The team wants to reduce false positives without losing detection of malicious tasks. Which tuning approach is most effective?

Change the rule to alert only on tasks created by SYSTEM

Disable the rule during business hours when IT automation runs

Lower the severity to informational so analysts ignore it

Create an allowlist of known IT automation task names and paths, and alert on any scheduled task creation outside that allowlist

Which of the following best describes a sensor in the context of endpoint data collection?

A central server that stores all logs from multiple hosts

A protocol used to encrypt data in transit

A hardware device that filters network traffic at the perimeter

A software component that monitors specific host activities and generates event data

GIAC Certified Detection Analyst

Domain 4Objective 1

Endpoint Analytics GCDA Practice Questions (Page 6)

Part of the Endpoint and User Analytics domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 26–30

26application · medium
A company's endpoint detection team needs to collect process creation, network connections, and file creation events from Windows workstations. They want to minimize the performance impact on user machines and avoid sending raw event logs to the central SIEM. Which approach best meets these requirements?
Select an answer first
27expert · hard
A detection team wants to detect a new malware variant that is polymorphic and changes its file hash each time it runs. They have observed that the malware always creates a mutex with a specific name and writes to a specific registry key. Which analytical technique is most effective?
Select an answer first
28application · medium
An analyst is investigating a possible data exfiltration from a Windows endpoint. The analyst suspects that a process read a sensitive file and then sent data over the network. Which combination of endpoint data sources would provide the strongest evidence?
Select an answer first
29application · medium
A detection rule for 'suspicious scheduled task creation' is alerting on legitimate IT automation tasks. The team wants to reduce false positives without losing detection of malicious tasks. Which tuning approach is most effective?
Select an answer first
30foundation · easy
Which of the following best describes a sensor in the context of endpoint data collection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.