During a ransomware incident, the incident response team uses an AI tool that automatically correlates alerts and suggests containment actions. The team is concerned about the AI's suggestions because they might disrupt business operations. What is the best practice for using AI in this situation?

Only use AI for detection, not for response

Ignore the AI's suggestions because they are not trustworthy

Let the AI execute all containment actions automatically to save time

Use the AI's suggestions as a starting point, but have a human approve each action

A security team is evaluating two AI-based malware detection tools. Tool A has a high detection rate but generates many false positives. Tool B has a lower detection rate but very few false positives. The team has limited analyst resources and must minimize alert fatigue. Which tool should they choose, and why?

Tool A, because a high detection rate is always more important

Choose Tool A and hire more analysts

Use both tools and investigate all alerts from both

Tool B, because fewer false positives reduce alert fatigue, even if some malware is missed

In a malware investigation, which activity best represents the integration of AI with traditional analysis?

Running malware in a sandbox without any AI tools

Reviewing code manually without any automated tools

Using an AI model to flag suspicious files and then manually verifying the findings

Only relying on antivirus signatures

When handling malware samples during an investigation, which ethical practice is most important?

Using malware to attack the attacker's systems

Deleting all samples immediately after analysis

Ensuring samples are contained and not allowed to spread

Sharing samples publicly without restrictions

GIAC Certified Incident Handler

Domain 1Objective 3

Malware and AI Assisted Investigations GCIH Practice Questions (Page 7)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 31–35

31application · medium
During a ransomware incident, the incident response team uses an AI tool that automatically correlates alerts and suggests containment actions. The team is concerned about the AI's suggestions because they might disrupt business operations. What is the best practice for using AI in this situation?
Select an answer first
32expert · hard
A security team is evaluating two AI-based malware detection tools. Tool A has a high detection rate but generates many false positives. Tool B has a lower detection rate but very few false positives. The team has limited analyst resources and must minimize alert fatigue. Which tool should they choose, and why?
Select an answer first
33foundation · easy
In a malware investigation, which activity best represents the integration of AI with traditional analysis?
Select an answer first
34foundation · easy
When handling malware samples during an investigation, which ethical practice is most important?
Select an answer first
35foundation · easy
Which technique involves executing malware in an isolated environment to observe its behavior, such as file system changes, registry modifications, and network connections?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Malware and AI Assisted Investigations GCIH Practice Questions (Page 7)

Questions 31–35

During a ransomware incident, the incident response team uses an AI tool that automatically correlates alerts and suggests containment actions. The team is concerned about the AI's suggestions because they might disrupt business operations. What is the best practice for using AI in this situation?

In a malware investigation, which activity best represents the integration of AI with traditional analysis?

When handling malware samples during an investigation, which ethical practice is most important?

Which technique involves executing malware in an isolated environment to observe its behavior, such as file system changes, registry modifications, and network connections?

Keep studying — Incident Response and Investigation