An incident responder in the EU is handling a breach that involves personal data of EU citizens. The company's legal counsel reminds the responder that GDPR requires certain notifications. What is the responder's primary obligation regarding the evidence collected?

Ensure that evidence handling complies with data protection principles, such as data minimization and purpose limitation.

Transfer all evidence to a non-EU country for analysis to avoid GDPR restrictions.

Ignore GDPR because incident response is exempt from data protection laws.

Delete all personal data from the evidence to avoid GDPR violations.

A company's critical application server is infected with a worm that is spreading to other servers. The incident response team must contain the worm, but the server cannot be taken offline because it processes real-time financial transactions. Which containment strategy best balances the need to stop the spread with the need to maintain business operations?

Shut down the server and restore from backup immediately.

Apply network segmentation and host-based firewall rules to block the worm's propagation ports while keeping the server online.

Do nothing and monitor the worm's behavior.

Disconnect the server from the network at the switch level, accepting the downtime.

An incident responder is investigating a case that may involve a violation of a company's acceptable use policy by an employee. The employee is suspected of using company resources for personal gain. The responder has collected evidence from the employee's workstation. What ethical consideration is most important when handling this evidence?

Ignore privacy concerns because the employee used company resources.

Respect the employee's privacy rights while ensuring the investigation complies with company policy and applicable laws.

Share the evidence with all employees to deter similar behavior.

Destroy the evidence if it is not directly related to the suspected violation.

An incident responder is handling a case that may involve criminal activity. The responder has collected evidence from the company's systems. What is the most important legal consideration when handing the evidence to law enforcement?

Ensure that the evidence was collected in a manner that preserves its integrity and chain of custody.

Delete any evidence that could be embarrassing to the company.

Provide law enforcement with all company data, including unrelated personal data.

Wait for a court order before sharing any evidence.

GIAC Certified Enterprise Defender

Domain 2Objective 1

Incident Response Concepts and Application GCED Practice Questions (Page 8)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

9concepts

Questions 36–40

36application · medium
An incident responder in the EU is handling a breach that involves personal data of EU citizens. The company's legal counsel reminds the responder that GDPR requires certain notifications. What is the responder's primary obligation regarding the evidence collected?
Select an answer first
37expert · hard
A company's critical application server is infected with a worm that is spreading to other servers. The incident response team must contain the worm, but the server cannot be taken offline because it processes real-time financial transactions. Which containment strategy best balances the need to stop the spread with the need to maintain business operations?
Select an answer first
38expert · hard
An incident responder is investigating a case that may involve a violation of a company's acceptable use policy by an employee. The employee is suspected of using company resources for personal gain. The responder has collected evidence from the employee's workstation. What ethical consideration is most important when handling this evidence?
Select an answer first
39expert · hard
An incident responder is handling a case that may involve criminal activity. The responder has collected evidence from the company's systems. What is the most important legal consideration when handing the evidence to law enforcement?
Select an answer first
40foundation · easy
Which incident response team role is primarily responsible for coordinating the technical investigation and analysis of an incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Incident Response Concepts and Application GCED Practice Questions (Page 8)

Questions 36–40

An incident responder in the EU is handling a breach that involves personal data of EU citizens. The company's legal counsel reminds the responder that GDPR requires certain notifications. What is the responder's primary obligation regarding the evidence collected?

An incident responder is handling a case that may involve criminal activity. The responder has collected evidence from the company's systems. What is the most important legal consideration when handing the evidence to law enforcement?

Which incident response team role is primarily responsible for coordinating the technical investigation and analysis of an incident?

Keep studying — Incident Response and Forensics