An incident handler is documenting the timeline of a security incident. Which information is most important to include for a complete timeline?

All relevant events with timestamps, including initial compromise, detection, and response actions.

The names of all employees involved, regardless of relevance.

Only the time the incident was discovered.

The estimated financial impact of the incident.

An incident handler is documenting evidence collected from a compromised server. Which practice is essential to maintain a proper chain of custody?

Only document the final analysis results, not the collection process.

Use a personal USB drive to transfer evidence to the analysis lab.

Record every person who handles the evidence, along with timestamps and purpose.

Store evidence in a shared folder accessible to all team members.

A multinational company's incident response team is investigating a breach that may involve personal data of EU citizens. The team is based in the United States and needs to share evidence with law enforcement in Europe. Which consideration is most critical when handling this evidence?

Anonymizing all personal data in the evidence before sharing it.

Obtaining legal advice on cross-border data transfer regulations, such as GDPR, before sharing the evidence.

Using a secure file-sharing service to send the evidence to law enforcement.

Ensuring that the evidence is encrypted during transfer to protect it from interception.

Which factor is most important when prioritizing incidents for response?

The skill level of the incident handler

The potential impact on business operations

The time of day the incident occurred

GIAC Certified Incident Handler

Domain 1Objective 1

Incident Response and Cyber Investigation GCIH Practice Questions (Page 8)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 36–40

36application · medium
An incident handler is documenting the timeline of a security incident. Which information is most important to include for a complete timeline?
Select an answer first
37application · medium
An incident handler is documenting evidence collected from a compromised server. Which practice is essential to maintain a proper chain of custody?
Select an answer first
38expert · hard
A multinational company's incident response team is investigating a breach that may involve personal data of EU citizens. The team is based in the United States and needs to share evidence with law enforcement in Europe. Which consideration is most critical when handling this evidence?
Select an answer first
39foundation · easy
Which phase of the incident response lifecycle involves identifying the scope of the incident and determining which systems are affected?
Select an answer first
40foundation · easy
Which factor is most important when prioritizing incidents for response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.