A user's workstation is infected with a keylogger that captures credentials. The attacker has used those credentials to access a file server and is now attempting to access other servers. You need to contain the incident with minimal disruption to the user's work. Which action should you take FIRST?

Run a memory dump on the workstation to identify the keylogger.

Isolate the workstation from the network and keep the account active.

Block the file server from the network.

Disable the user's domain account and reset the password.

You are investigating a breach where the attacker used the same compromised credentials to log into multiple servers. The logs show that the credentials were used from a single source IP that is not part of your organization. Which indicator of pivoting is most evident?

Large data exfiltration to an external IP

Credential reuse across multiple hosts

Unusual internal connections between servers

New administrative accounts created on servers

An EDR alert is triggered on a server because a process is injecting code into another process, which is a common technique used by malware to evade detection. Which detection technique is most effective at identifying this type of attack?

Network intrusion detection that looks for malicious traffic patterns.

Signature-based antivirus that matches the malware's file hash.

File integrity monitoring that checks for changes to system files.

Behavioral analysis that monitors for process injection and unusual API calls.

An attacker has compromised a web server and is using it to scan internal systems for open ports. The web server is not supposed to communicate with those internal systems. What is the attacker doing?

Performing a denial-of-service attack on the internal systems.

Installing malware on the internal systems.

Conducting a phishing campaign from the web server.

Using the web server as a pivot to perform reconnaissance on internal systems.

GIAC Certified Incident Handler

Domain 2Objective 3

Endpoint Attack and Pivoting GCIH Practice Questions (Page 3)

Part of the Attack Techniques and Detection domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 11–15

11expert · hard
A user's workstation is infected with a keylogger that captures credentials. The attacker has used those credentials to access a file server and is now attempting to access other servers. You need to contain the incident with minimal disruption to the user's work. Which action should you take FIRST?
Select an answer first
12application · medium
You are investigating a breach where the attacker used the same compromised credentials to log into multiple servers. The logs show that the credentials were used from a single source IP that is not part of your organization. Which indicator of pivoting is most evident?
Select an answer first
13foundation · easy
Which endpoint detection technique monitors and analyzes the behavior of processes and applications to identify malicious activities, even if no known signature exists?
Select an answer first
14application · medium
An EDR alert is triggered on a server because a process is injecting code into another process, which is a common technique used by malware to evade detection. Which detection technique is most effective at identifying this type of attack?
Select an answer first
15application · medium
An attacker has compromised a web server and is using it to scan internal systems for open ports. The web server is not supposed to communicate with those internal systems. What is the attacker doing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Endpoint Attack and Pivoting GCIH Practice Questions (Page 3)

Questions 11–15

You are investigating a breach where the attacker used the same compromised credentials to log into multiple servers. The logs show that the credentials were used from a single source IP that is not part of your organization. Which indicator of pivoting is most evident?

Which endpoint detection technique monitors and analyzes the behavior of processes and applications to identify malicious activities, even if no known signature exists?

An EDR alert is triggered on a server because a process is injecting code into another process, which is a common technique used by malware to evade detection. Which detection technique is most effective at identifying this type of attack?

An attacker has compromised a web server and is using it to scan internal systems for open ports. The web server is not supposed to communicate with those internal systems. What is the attacker doing?

Keep studying — Attack Techniques and Detection