After a series of incidents, the incident response team wants to improve its performance. The team has been tracking mean time to detect (MTTD) and mean time to respond (MTTR). Which additional metric would provide the most insight into the effectiveness of the containment phase?

Percentage of incidents contained within a predefined time threshold.

Number of tools used during the response.

In the NIST SP 800-61 incident response lifecycle, which phase involves actions taken to limit the scope and impact of an incident before eradication begins?

Containment, Eradication, and Recovery

A security analyst notices unusual outbound traffic from a workstation to an external IP address. The organization uses a SIEM and an EDR solution. Which combination of actions would provide the most complete picture for the initial investigation?

Immediately block the external IP address at the firewall and close the case.

Check the SIEM for related authentication events and the EDR for process execution history on the workstation.

Reimage the workstation and restore from backup.

Review only the firewall logs to see if other workstations communicated with the same IP.

When collecting a hard drive as evidence in an enterprise incident, what is the first step to preserve its integrity?

Create a forensic image of the drive

Boot the system to verify it works

A company's IR team is in the eradication phase of an incident involving a worm that spread through the network. The team has identified the root cause and is ready to clean affected systems. However, the business continuity plan requires that critical services be restored within 2 hours. The worm is known to reinfect systems if the network is not segmented. Which action best balances eradication and business continuity?

Keep all systems offline until every system is cleaned, regardless of BCP time objectives.

Clean all systems one by one, starting with the most critical, without network segmentation.

Restore critical services immediately from backups, even if the backups may contain the worm.

Segment the network to isolate infected systems, clean them in parallel, and restore critical services in a segmented environment while monitoring for reinfection.

GIAC Certified Forensic Analyst

Domain 1Objective 1

Enterprise Environment Incident Response GCFA Practice Questions (Page 9)

Part of the Incident Response Fundamentals domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 8–14 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

Questions 41–45

41expert · hard
After a series of incidents, the incident response team wants to improve its performance. The team has been tracking mean time to detect (MTTD) and mean time to respond (MTTR). Which additional metric would provide the most insight into the effectiveness of the containment phase?
Select an answer first
42foundation · easy
In the NIST SP 800-61 incident response lifecycle, which phase involves actions taken to limit the scope and impact of an incident before eradication begins?
Select an answer first
43application · medium
A security analyst notices unusual outbound traffic from a workstation to an external IP address. The organization uses a SIEM and an EDR solution. Which combination of actions would provide the most complete picture for the initial investigation?
Select an answer first
44foundation · easy
When collecting a hard drive as evidence in an enterprise incident, what is the first step to preserve its integrity?
Select an answer first
45expert · hard
A company's IR team is in the eradication phase of an incident involving a worm that spread through the network. The team has identified the root cause and is ready to clean affected systems. However, the business continuity plan requires that critical services be restored within 2 hours. The worm is known to reinfect systems if the network is not segmented. Which action best balances eradication and business continuity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.