A security team deploys an AI-based malware detection tool that flags a previously unknown executable as malicious based on its behavioral patterns. The tool reports a high confidence score, but a manual review of the file's strings and imports shows no obvious malicious indicators. What should the analyst do next?

Trust the AI tool's high confidence score and quarantine the file immediately.

Dismiss the AI alert because the file has no obvious malicious indicators.

Ask the AI tool to provide a detailed explanation of its decision before taking any action.

Combine the AI alert with additional dynamic analysis in a sandbox to validate the behavior.

An analyst is investigating a new ransomware variant. The AI-based sandbox reports that the sample encrypts files and deletes shadow copies. The analyst wants to confirm the encryption algorithm and identify the ransomware family. Which combination of traditional analysis techniques would best complement the AI findings?

Only rely on the AI sandbox report because it is automated

Perform static analysis of the binary's strings and imports, and use dynamic analysis to capture file system activity

Run the sample on a production server to observe real-world impact

Delete the sample immediately to prevent further infection

Which incident response task is AI most commonly used to automate?

Performing forensic disk imaging

Initial alert triage and prioritization

An incident responder is analyzing a suspicious document that reportedly drops a payload. The responder wants to observe the document's behavior in a controlled environment. Which approach best achieves this goal?

Inspect the document's metadata and embedded macros using a text editor.

Open the document in a disposable virtual machine with network monitoring and system snapshots.

Upload the document to a public malware analysis service.

Run an antivirus scan on the document to check for known signatures.

An incident responder is handling a malware sample that contains personal data of customers. The responder wants to use an AI-based analysis tool that requires uploading the sample to a cloud service. What is the most important consideration before proceeding?

Ask the AI tool to anonymize the sample before analysis.

Ensure the cloud service complies with data protection regulations and the organization's data handling policies.

Check if the AI tool can produce a detailed report quickly.

Verify that the AI tool has a high detection rate for known malware.

GIAC Certified Incident Handler

Domain 1Objective 3

Malware and AI Assisted Investigations GCIH Practice Questions (Page 9)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 41–45

41application · medium
A security team deploys an AI-based malware detection tool that flags a previously unknown executable as malicious based on its behavioral patterns. The tool reports a high confidence score, but a manual review of the file's strings and imports shows no obvious malicious indicators. What should the analyst do next?
Select an answer first
42application · medium
An analyst is investigating a new ransomware variant. The AI-based sandbox reports that the sample encrypts files and deletes shadow copies. The analyst wants to confirm the encryption algorithm and identify the ransomware family. Which combination of traditional analysis techniques would best complement the AI findings?
Select an answer first
43foundation · easy
Which incident response task is AI most commonly used to automate?
Select an answer first
44application · medium
An incident responder is analyzing a suspicious document that reportedly drops a payload. The responder wants to observe the document's behavior in a controlled environment. Which approach best achieves this goal?
Select an answer first
45application · medium
An incident responder is handling a malware sample that contains personal data of customers. The responder wants to use an AI-based analysis tool that requires uploading the sample to a cloud service. What is the most important consideration before proceeding?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Malware and AI Assisted Investigations GCIH Practice Questions (Page 9)

Questions 41–45

Which incident response task is AI most commonly used to automate?

An incident responder is analyzing a suspicious document that reportedly drops a payload. The responder wants to observe the document's behavior in a controlled environment. Which approach best achieves this goal?

An incident responder is handling a malware sample that contains personal data of customers. The responder wants to use an AI-based analysis tool that requires uploading the sample to a cloud service. What is the most important consideration before proceeding?

Keep studying — Incident Response and Investigation