During an investigation of a suspected insider threat, an incident handler needs to collect a copy of an employee's local user profile from a Windows workstation. The company is in a jurisdiction with strict data protection laws. Which method best preserves the integrity of the evidence while respecting legal requirements?

Create a forensic image of the hard drive using a write-blocker, hash the image, and store it on encrypted media with documented chain of custody.

Log into the user's account and copy relevant files to a cloud storage account for later analysis.

Use a write-blocker to create a forensic image of the entire hard drive and store it on a network share.

Copy the user profile folder to an external USB drive using standard Windows copy commands.

A company's incident response team discovers that an employee's personal cloud storage account was used to exfiltrate corporate data. The employee is in a country with strict privacy laws. The incident handler needs to preserve evidence. Which action is most appropriate?

Request the employee's consent to access the account and preserve the data.

Access the employee's personal account using credentials obtained from the employee's manager.

Immediately disable the employee's corporate account and delete the cloud data to prevent further loss.

Preserve corporate logs and network captures that show the exfiltration, and coordinate with legal counsel for any access to the personal account.

Which of the following is a primary responsibility of an incident handler during the response process?

Writing firewall rules to block all inbound traffic

Coordinating the response efforts and communicating with stakeholders

Deleting all logs to prevent further data exposure

Performing forensic analysis on all compromised systems

During an incident, an incident handler needs to collect network traffic logs from a firewall. Which action is most important to ensure the logs are admissible as evidence?

Export the logs to a CSV file and save it on the analyst's workstation.

Print the logs and store the paper copies in a locked cabinet.

Take screenshots of the logs and include them in the incident report.

Preserve the original logs in their native format with timestamps and hash values, and document the collection process.

A small company has just experienced a phishing attack that compromised one employee's email account. The incident handler is new and asks what the primary goal of incident response is in this situation. What is the best answer?

To determine the exact attack vector and publish a public report.

To ensure that all employees receive security awareness training.

To restore normal operations as quickly as possible while preserving evidence and preventing further damage.

To identify the attacker and press charges against them.

GIAC Certified Incident Handler

Domain 1Objective 1

Incident Response and Cyber Investigation GCIH Practice Questions (Page 2)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 6–10

6application · medium
During an investigation of a suspected insider threat, an incident handler needs to collect a copy of an employee's local user profile from a Windows workstation. The company is in a jurisdiction with strict data protection laws. Which method best preserves the integrity of the evidence while respecting legal requirements?
Select an answer first
7expert · hard
A company's incident response team discovers that an employee's personal cloud storage account was used to exfiltrate corporate data. The employee is in a country with strict privacy laws. The incident handler needs to preserve evidence. Which action is most appropriate?
Select an answer first
8foundation · easy
Which of the following is a primary responsibility of an incident handler during the response process?
Select an answer first
9application · medium
During an incident, an incident handler needs to collect network traffic logs from a firewall. Which action is most important to ensure the logs are admissible as evidence?
Select an answer first
10application · medium
A small company has just experienced a phishing attack that compromised one employee's email account. The incident handler is new and asks what the primary goal of incident response is in this situation. What is the best answer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.