An incident handler is interviewing a system administrator about a suspected breach. Which practice is most important for the interview to support the investigation?

Ask leading questions to confirm the handler's hypothesis.

Record the interview with the administrator's consent and take detailed notes.

Interview multiple witnesses together to save time.

Conduct the interview without any documentation to keep it informal.

A financial services company experiences a ransomware outbreak on a file server containing non-critical marketing data, while simultaneously detecting a possible credential theft from a domain controller. The incident handler has only one responder available. Which incident should be prioritized first?

The ransomware outbreak, because it is easier to contain and eradicate than a credential theft.

The domain controller credential theft, because it affects the authentication backbone and could enable lateral movement across the entire environment.

The ransomware outbreak, because it is actively encrypting files and causing immediate data loss.

Both incidents simultaneously, because all incidents deserve equal attention regardless of impact.

An incident handler is investigating a suspected intellectual property theft by a departing employee. The employee used a personal cloud storage account to upload company files. The company's legal team wants to obtain the cloud storage data. What is the most appropriate course of action?

Access the employee's personal cloud account using credentials obtained from the employee's computer.

Contact the cloud provider and ask them to provide the data informally.

Request the data through a legal process, such as a subpoena or court order.

Ask the employee to voluntarily provide access to the cloud account.

After a security incident is resolved, the incident response team conducts a lessons-learned meeting. What is the primary purpose of this meeting?

To identify what went well and what could be improved in the response process.

To decide whether to report the incident to law enforcement.

To assign blame for the incident.

To document the incident for legal purposes only.

What is the primary purpose of chain of custody in a cyber investigation?

To ensure that evidence is stored in a secure location

To ensure that evidence is collected in the order it was created

To encrypt all evidence to prevent unauthorized access

To document every person who handled the evidence and when

GIAC Certified Incident Handler

Domain 1Objective 1

Incident Response and Cyber Investigation GCIH Practice Questions (Page 9)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 41–45

41application · medium
An incident handler is interviewing a system administrator about a suspected breach. Which practice is most important for the interview to support the investigation?
Select an answer first
42application · medium
A financial services company experiences a ransomware outbreak on a file server containing non-critical marketing data, while simultaneously detecting a possible credential theft from a domain controller. The incident handler has only one responder available. Which incident should be prioritized first?
Select an answer first
43expert · hard
An incident handler is investigating a suspected intellectual property theft by a departing employee. The employee used a personal cloud storage account to upload company files. The company's legal team wants to obtain the cloud storage data. What is the most appropriate course of action?
Select an answer first
44application · medium
After a security incident is resolved, the incident response team conducts a lessons-learned meeting. What is the primary purpose of this meeting?
Select an answer first
45foundation · easy
What is the primary purpose of chain of custody in a cyber investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.