Which endpoint detection and response (EDR) capability goes beyond traditional antivirus by collecting and correlating endpoint telemetry to detect and investigate advanced threats?

Behavioral analytics and threat hunting

During an incident, you discover that an attacker has compromised a jump server and is using it to RDP into multiple internal servers. You need to stop the pivoting while preserving evidence for forensic analysis. Which action best achieves both goals?

Block RDP port 3389 on the firewall for all internal traffic.

Disconnect the jump server from the network but keep it powered on.

Immediately shut down the jump server.

Change the passwords of all internal servers.

Which of the following is a strategy to stop pivoting during an incident?

Resetting credentials used by the compromised host

Increasing the logging level on all systems

Conducting a vulnerability scan

A user receives an email with an attachment that, when opened, launches a PowerShell script that downloads and executes a payload. The antivirus does not detect the payload. Which detection method would be MOST effective at identifying this attack?

Behavioral monitoring of PowerShell execution

Your EDR solution is generating a high volume of alerts for a single workstation, but most are false positives. You need to reduce noise while still detecting real attacks. Which approach is most effective?

Increase the severity threshold so only critical alerts are shown.

Disable the EDR agent on that workstation to stop the alerts.

Replace the EDR with a traditional antivirus that has fewer alerts.

Tune the EDR rules to suppress alerts for known-good applications and focus on behavioral anomalies.

GIAC Certified Incident Handler

Domain 2Objective 3

Endpoint Attack and Pivoting GCIH Practice Questions (Page 8)

Part of the Attack Techniques and Detection domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 36–40

36foundation · easy
Which endpoint detection and response (EDR) capability goes beyond traditional antivirus by collecting and correlating endpoint telemetry to detect and investigate advanced threats?
Select an answer first
37application · medium
During an incident, you discover that an attacker has compromised a jump server and is using it to RDP into multiple internal servers. You need to stop the pivoting while preserving evidence for forensic analysis. Which action best achieves both goals?
Select an answer first
38foundation · easy
Which of the following is a strategy to stop pivoting during an incident?
Select an answer first
39application · medium
A user receives an email with an attachment that, when opened, launches a PowerShell script that downloads and executes a payload. The antivirus does not detect the payload. Which detection method would be MOST effective at identifying this attack?
Select an answer first
40expert · hard
Your EDR solution is generating a high volume of alerts for a single workstation, but most are false positives. You need to reduce noise while still detecting real attacks. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.