A company has a SIEM that collects logs from firewalls, servers, and endpoints. During an incident, the SIEM fails to ingest new logs due to a storage capacity issue. The incident response team needs to continue monitoring the attack. Which action is most appropriate?

Stop the SIEM from collecting logs to prevent further storage issues.

Switch to manual log review on individual systems.

Ignore the SIEM and rely on the EDR console for all monitoring.

Increase the SIEM storage capacity and prioritize critical log sources.

In an enterprise incident response escalation path, what is the primary purpose of a predefined escalation matrix?

To outline the steps for eradicating malware from affected systems

To document the technical details of the incident for forensic analysis

To provide a list of all available forensic tools and their capabilities

To ensure the right people are notified based on the severity and type of incident

GIAC Certified Forensic Analyst

Domain 1Objective 1

Enterprise Environment Incident Response GCFA Practice Questions (Page 11)

Part of the Incident Response Fundamentals domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 8–14 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

Questions 51–52

51expert · hard
A company has a SIEM that collects logs from firewalls, servers, and endpoints. During an incident, the SIEM fails to ingest new logs due to a storage capacity issue. The incident response team needs to continue monitoring the attack. Which action is most appropriate?
Select an answer first
52foundation · easy
In an enterprise incident response escalation path, what is the primary purpose of a predefined escalation matrix?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

Enterprise Environment Incident Response GCFA Practice Questions (Page 11)

Questions 51–52

A company has a SIEM that collects logs from firewalls, servers, and endpoints. During an incident, the SIEM fails to ingest new logs due to a storage capacity issue. The incident response team needs to continue monitoring the attack. Which action is most appropriate?

In an enterprise incident response escalation path, what is the primary purpose of a predefined escalation matrix?

Keep studying — Incident Response Fundamentals