An organization's incident response plan is being updated. The team wants to ensure that the plan includes specific steps for different types of incidents, such as malware, phishing, and insider threats. What is the best way to structure the plan?

Write a new plan from scratch for each incident.

Use a single generic procedure for all incidents.

Include only high-level principles and no specific steps.

Create separate playbooks for each incident type, with common procedures in a general section.

What is the primary purpose of an incident response playbook?

To provide step-by-step guidance for responding to specific types of incidents

To document the incident response team's roles and responsibilities

To list all possible incident types and their classifications

To replace the need for trained incident responders

During a forensic investigation, an analyst discovers that the suspect's computer contains personal files unrelated to the incident. The analyst's organization is subject to strict privacy regulations. What is the most appropriate action?

Examine all files to ensure nothing relevant is missed.

Ignore the personal files and do not mention them in any report.

Delete the personal files to protect the individual's privacy.

Document the existence of the personal files but do not examine their contents, and note them in the report.

A company has just finished eradicating malware from all affected systems and verified that the systems are clean. According to the incident response lifecycle, which phase should the team enter next?

Containment, because the team should continue isolating systems until recovery is complete.

Recovery, where systems are gradually returned to production and monitored for signs of recurrence.

Detection, because the team should verify that no other systems are infected.

Lessons learned, where the team reviews the incident and documents improvements.

A hospital's IT team detects ransomware on a single administrative workstation that contains no patient data. The hospital has a published incident response playbook that defines severity levels based on data sensitivity and system criticality. The playbook's highest severity level requires immediate activation of the full incident response team and notification of executive leadership. According to the playbook, which action should the team take first?

Activate the full incident response team and notify executive leadership because the playbook's highest severity level applies.

Wait for the incident commander to decide the severity before taking any action.

Ignore the playbook because ransomware always requires the highest severity response regardless of data.

Follow the playbook's lower-severity procedures, which likely involve isolating the workstation and notifying the incident commander.

GIAC Certified Enterprise Defender

Domain 2Objective 1

Incident Response Concepts and Application GCED Practice Questions (Page 9)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

9concepts

Questions 41–45

41expert · hard
An organization's incident response plan is being updated. The team wants to ensure that the plan includes specific steps for different types of incidents, such as malware, phishing, and insider threats. What is the best way to structure the plan?
Select an answer first
42foundation · easy
What is the primary purpose of an incident response playbook?
Select an answer first
43expert · hard
During a forensic investigation, an analyst discovers that the suspect's computer contains personal files unrelated to the incident. The analyst's organization is subject to strict privacy regulations. What is the most appropriate action?
Select an answer first
44application · easy
A company has just finished eradicating malware from all affected systems and verified that the systems are clean. According to the incident response lifecycle, which phase should the team enter next?
Select an answer first
45application · medium
A hospital's IT team detects ransomware on a single administrative workstation that contains no patient data. The hospital has a published incident response playbook that defines severity levels based on data sensitivity and system criticality. The playbook's highest severity level requires immediate activation of the full incident response team and notification of executive leadership. According to the playbook, which action should the team take first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.