In incident response, how can AI be used to enhance the triage process?

By automatically prioritizing alerts based on severity and relevance

By replacing all human decision-making

By guaranteeing accurate detection of all threats

By eliminating the need for incident response plans

During an incident, an analyst discovers a file that appears to be a legitimate PDF but contains embedded JavaScript that executes when opened. The file also has a high entropy section. Which type of malware behavior is most likely indicated?

A ransomware that encrypts files

A worm that self-replicates across the network

A rootkit that hides its presence

A trojan that masquerades as a legitimate document

An analyst is examining a suspicious binary that is packed. The analyst wants to perform static analysis. What is the most important first step?

Check the binary's digital signature.

Unpack the binary using a tool like UPX or a custom unpacker.

Run the binary in a sandbox to observe its behavior.

Search the binary's hash on VirusTotal.

A security team is evaluating an AI-based malware detection tool. The tool uses machine learning to classify files as malicious or benign. During a test, the tool misclassifies a benign file as malicious. What is the most likely cause of this false positive?

The training data did not include enough benign samples similar to the file.

The tool was not updated with the latest malware signatures.

The file was packed or obfuscated.

The tool uses static analysis only.

GIAC Certified Incident Handler

Domain 1Objective 3

Malware and AI Assisted Investigations GCIH Practice Questions (Page 2)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 6–10

6foundation · easy
In incident response, how can AI be used to enhance the triage process?
Select an answer first
7foundation · easy
Which static analysis method extracts readable text from a binary to identify URLs, IP addresses, or command-line arguments embedded in the malware?
Select an answer first
8application · medium
During an incident, an analyst discovers a file that appears to be a legitimate PDF but contains embedded JavaScript that executes when opened. The file also has a high entropy section. Which type of malware behavior is most likely indicated?
Select an answer first
9application · medium
An analyst is examining a suspicious binary that is packed. The analyst wants to perform static analysis. What is the most important first step?
Select an answer first
10application · medium
A security team is evaluating an AI-based malware detection tool. The tool uses machine learning to classify files as malicious or benign. During a test, the tool misclassifies a benign file as malicious. What is the most likely cause of this false positive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.