An incident handler is documenting evidence from a compromised server. The handler needs to ensure the evidence is admissible in court. Which practice is most critical?

Making multiple copies of the evidence and distributing them to the legal team.

Maintaining a detailed chain of custody that records every person who handled the evidence.

Storing the evidence on an encrypted USB drive to prevent unauthorized access.

Using the latest forensic tools to analyze the evidence.

A company's incident response team is triaging multiple alerts. Which alert should be considered the highest priority?

A successful login from an unusual geographic location for a privileged account.

A failed login attempt on a user's workstation.

A phishing email reported by one user.

A low-severity malware detection on a test server.

A company has a critical production database that is experiencing a denial-of-service attack, and at the same time, a low-priority server is confirmed to be infected with ransomware. The incident handler must allocate resources. Which approach is most effective?

Focus all resources on the ransomware because it is a confirmed incident.

Contain the ransomware quickly with minimal effort, then focus on mitigating the DoS attack.

Wait for management to decide which incident to handle first.

Focus all resources on the DoS attack because it affects a critical system.

A hospital's IT team detects a ransomware attack on its patient records system and a separate denial-of-service (DoS) attack on its public website. The incident response team has limited resources. Which incident should be prioritized?

The DoS attack, because it is easier to mitigate than ransomware.

The ransomware attack, because patient records are critical to patient safety and regulatory compliance.

Both incidents equally, because both are attacks on the organization.

The DoS attack, because it is actively affecting the public's ability to access the website.

Which of the following best describes the primary goal of incident response?

To identify the attacker and pursue legal action

To limit damage and restore normal operations as quickly as possible

To rebuild all affected systems from scratch

To collect as much evidence as possible for prosecution

GIAC Certified Incident Handler

Domain 1Objective 1

Incident Response and Cyber Investigation GCIH Practice Questions (Page 6)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 26–30

26expert · hard
An incident handler is documenting evidence from a compromised server. The handler needs to ensure the evidence is admissible in court. Which practice is most critical?
Select an answer first
27application · medium
A company's incident response team is triaging multiple alerts. Which alert should be considered the highest priority?
Select an answer first
28expert · hard
A company has a critical production database that is experiencing a denial-of-service attack, and at the same time, a low-priority server is confirmed to be infected with ransomware. The incident handler must allocate resources. Which approach is most effective?
Select an answer first
29expert · hard
A hospital's IT team detects a ransomware attack on its patient records system and a separate denial-of-service (DoS) attack on its public website. The incident response team has limited resources. Which incident should be prioritized?
Select an answer first
30foundation · easy
Which of the following best describes the primary goal of incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.