A security analyst is examining a suspicious binary that is not detected by antivirus. The analyst runs `strings` and finds URLs and IP addresses, but no suspicious API calls. The binary has a valid digital signature from a known software vendor. What should the analyst conclude from this static analysis?

The binary is safe because it has no suspicious API calls

The binary is likely malicious because it contains URLs and IPs

The binary requires further analysis because static indicators are inconclusive

The binary is definitely benign because it is signed

An incident response team is overwhelmed by a large number of alerts during a malware outbreak. They want to use AI to prioritize alerts for manual review. Which approach best leverages AI for triage while maintaining human oversight?

Replace the incident response team with an AI chatbot that handles all alerts

Configure the AI to automatically quarantine all endpoints that match a known malware signature

Use AI to score alerts based on severity and context, then have analysts review the top-scored alerts

Turn off all alerting until the outbreak is contained

Which of the following best describes a key advantage of AI-assisted malware detection over traditional signature-based detection?

Ability to identify novel or polymorphic malware

Eliminates the need for human analysts

Guarantees zero false positives

How do AI and machine learning tools primarily detect and classify malware?

By manually reviewing assembly code

By identifying patterns and anomalies in data

By executing malware in a virtual machine

By comparing file hashes to a known database

GIAC Certified Incident Handler

Domain 1Objective 3

Malware and AI Assisted Investigations GCIH Practice Questions (Page 1)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 1–5

1application · medium
A security analyst is examining a suspicious binary that is not detected by antivirus. The analyst runs `strings` and finds URLs and IP addresses, but no suspicious API calls. The binary has a valid digital signature from a known software vendor. What should the analyst conclude from this static analysis?
Select an answer first
2application · medium
An incident response team is overwhelmed by a large number of alerts during a malware outbreak. They want to use AI to prioritize alerts for manual review. Which approach best leverages AI for triage while maintaining human oversight?
Select an answer first
3foundation · easy
An incident responder identifies a malicious program that spreads to other systems by exploiting a network vulnerability without requiring user interaction. Which malware type does this describe?
Select an answer first
4foundation · easy
Which of the following best describes a key advantage of AI-assisted malware detection over traditional signature-based detection?
Select an answer first
5foundation · easy
How do AI and machine learning tools primarily detect and classify malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Malware and AI Assisted Investigations GCIH Practice Questions (Page 1)

Questions 1–5

An incident response team is overwhelmed by a large number of alerts during a malware outbreak. They want to use AI to prioritize alerts for manual review. Which approach best leverages AI for triage while maintaining human oversight?

An incident responder identifies a malicious program that spreads to other systems by exploiting a network vulnerability without requiring user interaction. Which malware type does this describe?

Which of the following best describes a key advantage of AI-assisted malware detection over traditional signature-based detection?

How do AI and machine learning tools primarily detect and classify malware?

Keep studying — Incident Response and Investigation