A data breach has occurred, and the incident response team is preparing to notify affected customers. The legal department has provided a draft notification that includes technical details about the attack vector. The communications lead is concerned that the notification may be too technical for customers. What should the communications lead do?

Send the notification as drafted by legal, because legal requirements take precedence over clarity.

Ask the lead analyst to rewrite the notification using more technical language.

Work with the legal department to revise the notification to include clear, non-technical language while ensuring legal requirements are met.

Refuse to send any notification until the technical details are removed entirely.

A large organization experiences a multi-system malware outbreak. The incident response team is activated. The incident commander is coordinating efforts, but the lead analyst is overwhelmed with forensic tasks. Which action best supports the team's effectiveness?

Assign additional analysts to assist the lead analyst and have the incident commander prioritize tasks.

Ask the communications lead to perform forensic analysis.

Stop all other incident response activities until the lead analyst catches up.

Have the incident commander take over forensic analysis directly.

A company experiences a ransomware attack that encrypts critical files. The incident response team has restored the systems from backups, but the CEO wants to know if the company should pay the ransom. The legal team advises against payment due to sanctions. What should the incident response team do?

Ask the CEO to make the final decision without legal input.

Pay the ransom because it is the fastest way to recover data.

Ignore the legal team and pay the ransom to avoid business disruption.

Follow the legal team's advice and do not pay the ransom; focus on recovery and reporting.

A forensic analyst is examining a compromised Windows server. The analyst needs to determine which user accounts were used to log on to the system around the time of the incident. Which forensic artifact is most likely to provide this information?

The system's pagefile.sys, which may contain remnants of logon credentials.

The browser history of the default user profile.

Windows Event Logs, specifically Security logs with logon event IDs 4624 and 4625.

The Windows Prefetch files, which show recently executed programs.

GIAC Certified Enterprise Defender

Domain 2Objective 1

Incident Response Concepts and Application GCED Practice Questions (Page 6)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

9concepts

Questions 26–30

26foundation · easy
During which phase of the incident response lifecycle does an organization establish policies, tools, and training before an incident occurs?
Select an answer first
27expert · hard
A data breach has occurred, and the incident response team is preparing to notify affected customers. The legal department has provided a draft notification that includes technical details about the attack vector. The communications lead is concerned that the notification may be too technical for customers. What should the communications lead do?
Select an answer first
28application · medium
A large organization experiences a multi-system malware outbreak. The incident response team is activated. The incident commander is coordinating efforts, but the lead analyst is overwhelmed with forensic tasks. Which action best supports the team's effectiveness?
Select an answer first
29expert · hard
A company experiences a ransomware attack that encrypts critical files. The incident response team has restored the systems from backups, but the CEO wants to know if the company should pay the ransom. The legal team advises against payment due to sanctions. What should the incident response team do?
Select an answer first
30application · medium
A forensic analyst is examining a compromised Windows server. The analyst needs to determine which user accounts were used to log on to the system around the time of the incident. Which forensic artifact is most likely to provide this information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Incident Response Concepts and Application GCED Practice Questions (Page 6)

Questions 26–30

During which phase of the incident response lifecycle does an organization establish policies, tools, and training before an incident occurs?

A large organization experiences a multi-system malware outbreak. The incident response team is activated. The incident commander is coordinating efforts, but the lead analyst is overwhelmed with forensic tasks. Which action best supports the team's effectiveness?

A forensic analyst is examining a compromised Windows server. The analyst needs to determine which user accounts were used to log on to the system around the time of the incident. Which forensic artifact is most likely to provide this information?

Keep studying — Incident Response and Forensics