An incident responder is collecting evidence from a compromised server that is also a critical production system. The server cannot be taken offline without causing significant business disruption. The responder needs to preserve evidence for potential legal action. Which approach best balances the need for evidence preservation with business continuity?

Copy the entire hard drive over the network while the system is running, without any write-blocker.

Force a shutdown of the server to perform a dead acquisition, despite the business disruption.

Take screenshots of the system and skip forensic acquisition to avoid disruption.

Perform a live forensic acquisition of volatile data and a logical copy of relevant files, documenting the process and maintaining chain of custody.

A large organization is responding to a multi-system breach. The incident commander is coordinating the response, but the lead analyst is unavailable due to illness. Which action best maintains the effectiveness of the incident response team?

Ask the communications lead to take over the lead analyst role.

Pause the investigation until the lead analyst returns.

Have the incident commander perform the forensic analysis in addition to coordinating.

Appoint a qualified backup analyst from the team to serve as lead analyst and continue the investigation.

What is the primary purpose of an incident response report?

To provide a public statement to the media

To replace the need for a lessons-learned meeting

To assign blame for the incident

To document the incident timeline, actions taken, and findings

Which stakeholder group should receive regular incident status updates during an active incident?

Only the incident response team

All employees, including those not affected

Executive management and affected business units

Which factor is most important when prioritizing incident response actions?

The cost of the incident response tools

The impact on business operations and urgency

The time of day the incident occurred

GIAC Certified Enterprise Defender

Domain 2Objective 1

Incident Response Concepts and Application GCED Practice Questions (Page 5)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

9concepts

Questions 21–25

21expert · hard
An incident responder is collecting evidence from a compromised server that is also a critical production system. The server cannot be taken offline without causing significant business disruption. The responder needs to preserve evidence for potential legal action. Which approach best balances the need for evidence preservation with business continuity?
Select an answer first
22application · medium
A large organization is responding to a multi-system breach. The incident commander is coordinating the response, but the lead analyst is unavailable due to illness. Which action best maintains the effectiveness of the incident response team?
Select an answer first
23foundation · easy
What is the primary purpose of an incident response report?
Select an answer first
24foundation · easy
Which stakeholder group should receive regular incident status updates during an active incident?
Select an answer first
25foundation · easy
Which factor is most important when prioritizing incident response actions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.