A security analyst notices that a user's workstation is running a process that spawns child processes in a pattern not seen before, and the process is making outbound connections to a domain that was registered last week. The antivirus has not flagged the process. Which detection technique is MOST likely to have raised this alert?

Network intrusion detection system (NIDS) on the perimeter

A workstation is infected with ransomware that has encrypted local files and is attempting to spread to network shares. You need to contain the infection and prevent further spread. Which action should you take first?

Disconnect the network shares from the workstation.

Run a full antivirus scan on the workstation.

Isolate the workstation from the network immediately.

Notify the user and ask them to close the ransomware window.

A user receives an email that appears to be from their bank, asking them to click a link and verify their account. The link leads to a fake website that captures their credentials. What type of attack is this?

Exploit of a software vulnerability

A user clicked a link in a phishing email, and their machine is now running cryptocurrency mining malware. The malware is using the machine's CPU and making outbound connections to a mining pool. Which containment action is most appropriate for this endpoint?

Disable the user's account and require a password reset.

Apply the latest security patches to the operating system.

Kill the mining process and delete the malware file from disk.

Isolate the machine from the network and block the mining pool's domain at the firewall.

GIAC Certified Incident Handler

Domain 2Objective 3

Endpoint Attack and Pivoting GCIH Practice Questions (Page 2)

Part of the Attack Techniques and Detection domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 6–10

6application · medium
A security analyst notices that a user's workstation is running a process that spawns child processes in a pattern not seen before, and the process is making outbound connections to a domain that was registered last week. The antivirus has not flagged the process. Which detection technique is MOST likely to have raised this alert?
Select an answer first
7foundation · easy
Which of the following is an indicator of pivoting that involves the use of the same credentials on multiple systems?
Select an answer first
8application · medium
A workstation is infected with ransomware that has encrypted local files and is attempting to spread to network shares. You need to contain the infection and prevent further spread. Which action should you take first?
Select an answer first
9application · medium
A user receives an email that appears to be from their bank, asking them to click a link and verify their account. The link leads to a fake website that captures their credentials. What type of attack is this?
Select an answer first
10application · medium
A user clicked a link in a phishing email, and their machine is now running cryptocurrency mining malware. The malware is using the machine's CPU and making outbound connections to a mining pool. Which containment action is most appropriate for this endpoint?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Endpoint Attack and Pivoting GCIH Practice Questions (Page 2)

Questions 6–10

Which of the following is an indicator of pivoting that involves the use of the same credentials on multiple systems?

A workstation is infected with ransomware that has encrypted local files and is attempting to spread to network shares. You need to contain the infection and prevent further spread. Which action should you take first?

A user receives an email that appears to be from their bank, asking them to click a link and verify their account. The link leads to a fake website that captures their credentials. What type of attack is this?

A user clicked a link in a phishing email, and their machine is now running cryptocurrency mining malware. The malware is using the machine's CPU and making outbound connections to a mining pool. Which containment action is most appropriate for this endpoint?

Keep studying — Attack Techniques and Detection