A company's incident response team is investigating a breach that may involve protected health information (PHI). The team needs to share evidence with a third-party forensic firm. Which action is most appropriate to comply with privacy regulations?

Anonymize the PHI before sharing the evidence with the forensic firm.

Refuse to share any evidence with the forensic firm to avoid legal issues.

Sign a business associate agreement (BAA) with the forensic firm and use a secure file transfer method.

Share the evidence via an unencrypted email to expedite the investigation.

Which of the following is a key principle of evidence handling in a cyber investigation?

Always work on the original evidence to avoid missing details

Preserve the original evidence and work on a copy

Minimize the number of people who handle the evidence

Delete any irrelevant data to simplify the investigation

During an incident, an incident handler needs to collect a memory dump from a compromised server. Which tool or method is most appropriate for preserving the memory evidence?

Copy the pagefile.sys file to a network share.

Take a screenshot of the task manager to show running processes.

Reboot the server to clear memory and then collect the dump.

Use a trusted memory acquisition tool to capture the RAM contents to an external drive.

An incident handler is investigating a case that may involve a minor's personal data. The organization is subject to COPPA (Children's Online Privacy Protection Act). What is the most important consideration during the investigation?

Ignoring COPPA because the investigation is internal.

Sharing the minor's data with all investigators to speed up the investigation.

Deleting all data related to the minor to protect their privacy.

Ensuring that the investigation complies with COPPA's parental consent requirements.

GIAC Certified Incident Handler

Domain 1Objective 1

Incident Response and Cyber Investigation GCIH Practice Questions (Page 1)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 1–5

1foundation · easy
In the incident response lifecycle, which phase involves restoring systems to normal operation after the threat has been removed?
Select an answer first
2expert · hard
A company's incident response team is investigating a breach that may involve protected health information (PHI). The team needs to share evidence with a third-party forensic firm. Which action is most appropriate to comply with privacy regulations?
Select an answer first
3foundation · easy
Which of the following is a key principle of evidence handling in a cyber investigation?
Select an answer first
4application · medium
During an incident, an incident handler needs to collect a memory dump from a compromised server. Which tool or method is most appropriate for preserving the memory evidence?
Select an answer first
5application · medium
An incident handler is investigating a case that may involve a minor's personal data. The organization is subject to COPPA (Children's Online Privacy Protection Act). What is the most important consideration during the investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.