After containing a malware outbreak, the incident response team is planning to restore systems from backups. According to the incident response lifecycle, which phase are they entering?

Containment, Eradication, and Recovery

Which of the following is the most appropriate way to preserve digital evidence from a running system?

Copy all files to a USB drive and then power off the system

Run a full antivirus scan to ensure the system is clean

Immediately power off the system to prevent further changes

Capture volatile data first, then create a forensic image of the disk

An incident handler is collecting evidence from a compromised web server. Which piece of evidence is most likely to be volatile and require immediate collection?

The configuration files of the web server.

The web server's access logs stored on disk.

The contents of the server's memory (RAM).

During an investigation of a suspected insider threat, an incident handler needs to collect a laptop's hard drive as evidence. The laptop is currently running and the user is still logged in. Which action best preserves the integrity of the evidence?

Power off the laptop immediately and then remove the hard drive for imaging.

Copy the user's files to an external drive and then document the copy in the chain of custody.

Create a forensic image of the hard drive while the system is running, using a write-blocker.

Perform a live acquisition of volatile data first, then shut down the system and create a forensic image of the hard drive using a write-blocker.

A multinational company experiences a data breach involving personal data of EU citizens. The incident handler must coordinate with legal counsel. Which action is most appropriate to ensure compliance with GDPR while preserving evidence?

Transfer all affected data to a non-EU country to avoid GDPR obligations.

Immediately delete all affected personal data to minimize the breach impact.

Preserve all relevant evidence, including logs and system images, and notify the supervisory authority within 72 hours if required.

Wait for law enforcement to provide a formal request before preserving any data.

GIAC Certified Incident Handler

Domain 1Objective 1

Incident Response and Cyber Investigation GCIH Practice Questions (Page 4)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 16–20

16application · medium
After containing a malware outbreak, the incident response team is planning to restore systems from backups. According to the incident response lifecycle, which phase are they entering?
Select an answer first
17foundation · easy
Which of the following is the most appropriate way to preserve digital evidence from a running system?
Select an answer first
18application · medium
An incident handler is collecting evidence from a compromised web server. Which piece of evidence is most likely to be volatile and require immediate collection?
Select an answer first
19application · medium
During an investigation of a suspected insider threat, an incident handler needs to collect a laptop's hard drive as evidence. The laptop is currently running and the user is still logged in. Which action best preserves the integrity of the evidence?
Select an answer first
20expert · hard
A multinational company experiences a data breach involving personal data of EU citizens. The incident handler must coordinate with legal counsel. Which action is most appropriate to ensure compliance with GDPR while preserving evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.