A company's EDR solution has flagged a suspicious process on several endpoints. The IR team needs to determine if the process is malicious and whether it has spread. Which combination of tools would provide the most comprehensive view?

Use the EDR to collect endpoint telemetry and a SIEM to correlate the alerts across the network.

Use a vulnerability scanner to check for missing patches on all endpoints.

Use a packet capture tool on a single switch to analyze all network traffic.

Use only the EDR to check the process on one endpoint.

What is the primary purpose of an after-action report (AAR) in enterprise incident response?

To provide real-time updates to stakeholders during the incident

To serve as a legal document for court proceedings

To assign blame for the incident to specific individuals

To document the incident timeline and identify lessons learned for improvement

What is the primary role of the business continuity plan (BCP) during an enterprise incident response?

To ensure critical business functions continue operating during and after an incident

To collect and preserve digital evidence for legal proceedings

To provide step-by-step instructions for eradicating malware

To communicate with external regulatory bodies

Which type of tool is most commonly used to investigate a compromised endpoint by examining running processes, memory, and file system artifacts?

Endpoint Detection and Response (EDR)

A company is updating its incident response policy. The policy must define the criteria for declaring an incident and the escalation path. Which component is most essential to include in the policy to ensure consistent and effective response?

A list of all employees' personal phone numbers for emergency contact.

The exact malware signatures that must be present to declare an incident.

A clear definition of incident severity levels and the corresponding escalation triggers and response actions.

A requirement to notify the media within 30 minutes of any security event.

GIAC Certified Forensic Analyst

Domain 1Objective 1

Enterprise Environment Incident Response GCFA Practice Questions (Page 1)

Part of the Incident Response Fundamentals domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 8–14 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

Questions 1–5

1application · medium
A company's EDR solution has flagged a suspicious process on several endpoints. The IR team needs to determine if the process is malicious and whether it has spread. Which combination of tools would provide the most comprehensive view?
Select an answer first
2foundation · easy
What is the primary purpose of an after-action report (AAR) in enterprise incident response?
Select an answer first
3foundation · easy
What is the primary role of the business continuity plan (BCP) during an enterprise incident response?
Select an answer first
4foundation · easy
Which type of tool is most commonly used to investigate a compromised endpoint by examining running processes, memory, and file system artifacts?
Select an answer first
5application · medium
A company is updating its incident response policy. The policy must define the criteria for declaring an incident and the escalation path. Which component is most essential to include in the policy to ensure consistent and effective response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.