What is the primary reason for hashing digital evidence during collection?

To verify that the evidence has not been altered since collection

To encrypt the evidence so that only authorized personnel can view it

To compress the evidence to save storage space

To index the evidence for faster searching

Which of the following best describes the purpose of incident triage?

To collect all possible evidence from the incident

To quickly assess and prioritize incidents based on severity and impact

To contain the incident as quickly as possible

To determine the root cause of the incident

During an investigation, an incident handler needs to collect logs from a Linux server. Which command is most appropriate to preserve the logs without altering their content?

cat /var/log/auth.log > /evidence/auth.log

tar -cf /evidence/auth.log.tar /var/log/auth.log

cp /var/log/auth.log /evidence/auth.log

dd if=/var/log/auth.log of=/evidence/auth.log bs=512 conv=noerror,sync

Which of the following is a primary legal consideration when handling personal data during an incident investigation?

Deleting all personal data immediately after the investigation

Sharing all collected data with law enforcement

Complying with applicable privacy laws and regulations

Ensuring that the data is encrypted at rest

An incident handler in a healthcare organization is investigating a breach that may involve protected health information (PHI). The organization is subject to HIPAA. Which action is most important during the investigation?

Focus solely on eradicating the threat to prevent further data loss.

Ensure that the investigation complies with HIPAA privacy and security rules while preserving evidence.

Share the PHI with all members of the incident response team for analysis.

Notify law enforcement immediately before any internal investigation.

GIAC Certified Incident Handler

Domain 1Objective 1

Incident Response and Cyber Investigation GCIH Practice Questions (Page 10)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 46–50

46foundation · easy
What is the primary reason for hashing digital evidence during collection?
Select an answer first
47foundation · easy
Which of the following best describes the purpose of incident triage?
Select an answer first
48application · medium
During an investigation, an incident handler needs to collect logs from a Linux server. Which command is most appropriate to preserve the logs without altering their content?
Select an answer first
49foundation · easy
Which of the following is a primary legal consideration when handling personal data during an incident investigation?
Select an answer first
50expert · hard
An incident handler in a healthcare organization is investigating a breach that may involve protected health information (PHI). The organization is subject to HIPAA. Which action is most important during the investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.