A malware outbreak is detected on several workstations. The malware is known to spread via SMB and uses a specific named pipe. You need to contain the outbreak while maintaining business operations. Which containment strategy is most appropriate?

Block SMB traffic between workstations at the switch level.

Shut down the file server that hosts the shared folders.

Disconnect all workstations from the network immediately.

Change all user passwords immediately.

During incident response for an endpoint attack, which of the following actions is part of the containment phase?

Isolating the affected system from the network

Conducting a lessons-learned review

Restoring the system from a backup

Analyzing the malware in a sandbox

During an incident, you notice that a compromised web server is making outbound connections to an internal database server on port 1433, even though the web application does not use that database. The database server is not directly exposed to the internet. What does this behavior most likely indicate?

The attacker is using the web server as a pivot to reach internal resources.

The database server is infected with malware that is phoning home.

The web server is being used for DNS tunneling.

The web server is performing routine database backups.

Your EDR alerts on a workstation because it is making repeated SMB connections to multiple internal hosts on port 445 within a short time. The user is a marketing employee who normally accesses only file shares on two specific servers. What should be your first hypothesis?

The workstation is compromised and is being used to scan for other SMB-accessible systems.

The user is downloading large files from the internet.

The workstation is performing automatic Windows updates.

The user is running a legitimate network inventory tool.

GIAC Certified Incident Handler

Domain 2Objective 3

Endpoint Attack and Pivoting GCIH Practice Questions (Page 7)

Part of the Attack Techniques and Detection domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 31–35

31foundation · easy
Which of the following is an example of an endpoint attack vector that exploits a software flaw in an application running on the endpoint?
Select an answer first
32application · medium
A malware outbreak is detected on several workstations. The malware is known to spread via SMB and uses a specific named pipe. You need to contain the outbreak while maintaining business operations. Which containment strategy is most appropriate?
Select an answer first
33foundation · easy
During incident response for an endpoint attack, which of the following actions is part of the containment phase?
Select an answer first
34application · medium
During an incident, you notice that a compromised web server is making outbound connections to an internal database server on port 1433, even though the web application does not use that database. The database server is not directly exposed to the internet. What does this behavior most likely indicate?
Select an answer first
35application · medium
Your EDR alerts on a workstation because it is making repeated SMB connections to multiple internal hosts on port 445 within a short time. The user is a marketing employee who normally accesses only file shares on two specific servers. What should be your first hypothesis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Endpoint Attack and Pivoting GCIH Practice Questions (Page 7)

Questions 31–35

Which of the following is an example of an endpoint attack vector that exploits a software flaw in an application running on the endpoint?

A malware outbreak is detected on several workstations. The malware is known to spread via SMB and uses a specific named pipe. You need to contain the outbreak while maintaining business operations. Which containment strategy is most appropriate?

During incident response for an endpoint attack, which of the following actions is part of the containment phase?

Your EDR alerts on a workstation because it is making repeated SMB connections to multiple internal hosts on port 445 within a short time. The user is a marketing employee who normally accesses only file shares on two specific servers. What should be your first hypothesis?

Keep studying — Attack Techniques and Detection