A security team is deploying an AI-based malware detection system. They have two datasets: one with labeled malware samples and one with unlabeled network traffic. They want to improve detection of new, unknown malware. Which approach is most effective?

Use unsupervised learning on the unlabeled network traffic to detect anomalies

Combine both datasets and train a semi-supervised model

Use only signature-based detection because AI is not reliable

Train a supervised model on the labeled malware samples only

A SOC receives hundreds of alerts per day, many of which are false positives. The team wants to use AI to reduce alert fatigue while ensuring critical incidents are not missed. Which approach best balances automation and human oversight?

Use AI to triage and prioritize alerts, but require human review for high-priority alerts.

Have the AI generate detailed reports for every alert, but take no action automatically.

Configure the AI to automatically resolve all low-priority alerts without human review.

Disable all alerts and rely solely on the AI's recommendations.

A malware analyst is using an AI-based tool that was trained on a dataset containing sensitive employee information. The analyst wants to publish a research paper about the malware family. What is the most appropriate action regarding the AI model and data?

Publish only the AI model's findings, ensuring no sensitive data is included

Do not publish anything because AI research is too risky

Publish the data after anonymizing it, even if anonymization is not perfect

Publish the AI model's weights and the training data to be transparent

A malware analyst is about to execute a ransomware sample in a sandbox. The sample is known to communicate with a command-and-control server. What is the most important ethical and legal consideration?

Obtain written permission from the malware author before executing the sample.

Avoid executing the sample to prevent any potential legal liability.

Ensure the sandbox is isolated from the production network to prevent real-world impact.

Ensure the sandbox has internet access so the malware can communicate with its C2 server.

A malware sample is suspected of downloading additional payloads from a remote server. The analyst wants to confirm this behavior without risking the production network. Which approach is most appropriate?

Execute the sample in a sandbox with simulated network services (e.g., INetSim) to capture and log connection attempts.

Use an AI-based tool to predict the behavior without executing the sample.

Execute the sample on a production system with network monitoring.

Perform static analysis to find the download URLs.

GIAC Certified Incident Handler

Domain 1Objective 3

Malware and AI Assisted Investigations GCIH Practice Questions (Page 8)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 36–40

36expert · hard
A security team is deploying an AI-based malware detection system. They have two datasets: one with labeled malware samples and one with unlabeled network traffic. They want to improve detection of new, unknown malware. Which approach is most effective?
Select an answer first
37application · medium
A SOC receives hundreds of alerts per day, many of which are false positives. The team wants to use AI to reduce alert fatigue while ensuring critical incidents are not missed. Which approach best balances automation and human oversight?
Select an answer first
38application · medium
A malware analyst is using an AI-based tool that was trained on a dataset containing sensitive employee information. The analyst wants to publish a research paper about the malware family. What is the most appropriate action regarding the AI model and data?
Select an answer first
39application · medium
A malware analyst is about to execute a ransomware sample in a sandbox. The sample is known to communicate with a command-and-control server. What is the most important ethical and legal consideration?
Select an answer first
40application · medium
A malware sample is suspected of downloading additional payloads from a remote server. The analyst wants to confirm this behavior without risking the production network. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.