A financial services firm discovers that an employee's laptop was used to access a customer database without authorization. The incident response team must collect evidence for potential legal action. Which step is most important to ensure the evidence is admissible in court?

Run a quick antivirus scan to ensure the laptop is clean.

Notify the employee's manager before any forensic activity.

Copy the entire hard drive using a standard file copy command.

Document who handled the evidence and when, with a signed chain-of-custody log.

A security analyst receives two alerts: one about a low-severity malware infection on a single user's workstation, and another about a suspected data exfiltration from a database server. The analyst has limited time. Which incident should be prioritized?

The malware infection, because it might spread to other systems.

The data exfiltration, because it has higher impact and urgency.

Both equally, because all incidents are equally important.

The malware infection, because it is easier to fix.

Which legal consideration is most important when handling personal data during an incident response?

Sharing personal data with any law enforcement agency that requests it

Ensuring the data is stored in the same country where the incident occurred

Complying with applicable privacy and data protection regulations

Deleting all personal data immediately to avoid liability

A forensic analyst is examining a compromised Windows system. The analyst wants to determine which user accounts were created or modified around the time of the incident. Which Windows artifact would be most useful?

The SAM registry hive and Security event logs.

GIAC Certified Enterprise Defender

Domain 2Objective 1

Incident Response Concepts and Application GCED Practice Questions (Page 4)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

9concepts

Questions 16–20

16foundation · easy
Which ethical principle requires incident responders to avoid exceeding their authorized scope during an investigation?
Select an answer first
17application · medium
A financial services firm discovers that an employee's laptop was used to access a customer database without authorization. The incident response team must collect evidence for potential legal action. Which step is most important to ensure the evidence is admissible in court?
Select an answer first
18application · medium
A security analyst receives two alerts: one about a low-severity malware infection on a single user's workstation, and another about a suspected data exfiltration from a database server. The analyst has limited time. Which incident should be prioritized?
Select an answer first
19foundation · easy
Which legal consideration is most important when handling personal data during an incident response?
Select an answer first
20application · medium
A forensic analyst is examining a compromised Windows system. The analyst wants to determine which user accounts were created or modified around the time of the incident. Which Windows artifact would be most useful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.