A security engineer is designing an automated reconnaissance tool that uses an LLM to parse and summarize public data about a target organization. The tool will run continuously and feed summaries into a reporting dashboard. Which integration approach is most appropriate?

Use an autonomous agent that makes decisions and executes actions without human oversight.

Use a plugin that allows the LLM to directly access the target's internal network.

Use the LLM's API to process data in batch and store results in a database.

Use the LLM to generate a full penetration test report without any manual review.

Which of the following is a typical prompt injection technique used to leak sensitive information from an LLM?

Sending multiple requests to the LLM to exhaust its rate limit.

Including a directive in the prompt that instructs the LLM to ignore its previous instructions and output its system prompt.

Using a longer prompt to increase the LLM's context window usage.

Modifying the LLM's temperature setting to increase response randomness.

How can an LLM be used to automate reconnaissance in offensive operations?

By summarizing and correlating information gathered from multiple public sources to identify potential targets.

By directly scanning network ports and services on a target system.

By exploiting vulnerabilities in the target's web application.

By sending crafted packets to the target to test firewall rules.

A security analyst is using an LLM to automate the collection of threat intelligence from public sources. The analyst wants to ensure the LLM does not inadvertently leak sensitive information about their own organization. Which practice is most important?

Sanitize all prompts to remove any internal or sensitive data before sending them to the LLM.

Use the LLM only for summarizing public data, not for generating new content.

Use the LLM in a sandboxed environment with no network access.

Use a public LLM that is known to have strong privacy protections.

During an incident response, a defender finds a blog post that appears to be written by the attacker, but the technical details are inaccurate and inconsistent with the actual attack. What is the most likely purpose of this post?

The attacker made a mistake and published incorrect information.

The blog post is a honeypot set up by another defender.

The attacker used an LLM to generate a false narrative to mislead defenders and create a false trail.

The blog post is unrelated to the attack and is a coincidence.

GIAC Certified Incident Handler

Domain 6Objective 1

Integrating LLMs with Offensive Operations GCIH Practice Questions (Page 5)

Part of the Emerging Technologies and Offensive Operations domain, which makes up ~5% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

Questions 21–25

21application · medium
A security engineer is designing an automated reconnaissance tool that uses an LLM to parse and summarize public data about a target organization. The tool will run continuously and feed summaries into a reporting dashboard. Which integration approach is most appropriate?
Select an answer first
22foundation · easy
Which of the following is a typical prompt injection technique used to leak sensitive information from an LLM?
Select an answer first
23foundation · easy
How can an LLM be used to automate reconnaissance in offensive operations?
Select an answer first
24application · medium
A security analyst is using an LLM to automate the collection of threat intelligence from public sources. The analyst wants to ensure the LLM does not inadvertently leak sensitive information about their own organization. Which practice is most important?
Select an answer first
25application · medium
During an incident response, a defender finds a blog post that appears to be written by the attacker, but the technical details are inaccurate and inconsistent with the actual attack. What is the most likely purpose of this post?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.