In a packet capture, you see a TCP connection where the client sends a SYN packet, the server responds with SYN-ACK, and the client sends an ACK. Then the client immediately sends a RST packet. What is the most likely explanation?

The server is refusing the connection

The client is experiencing network issues

The client is sending a malformed packet

The client is performing a TCP connect scan

You are writing the executive summary of an incident report. What is the most important element to include?

A high-level overview of the incident, impact, and recommended actions

A detailed list of all indicators of compromise

The names of the incident responders

The raw log excerpts from the firewall

You are building a timeline of an incident. You have logs from multiple sources with different time zones. What is the best practice to ensure an accurate timeline?

Ignore time zones and use the timestamps as-is

Use the local time of the analyst

Use the time zone of the first log source

An incident responder is correlating logs from a firewall, an IDS, and a web server. The firewall log shows a connection from an external IP to the web server on port 80, the IDS log shows a signature match for SQL injection, and the web server log shows a request containing 'UNION SELECT' in the URL. What is the most likely conclusion?

The external IP is a false positive

The web server has been compromised

The web server was likely targeted with a SQL injection attempt

GIAC Certified Incident Handler

Domain 1Objective 2

Network and Log Investigations GCIH Practice Questions (Page 2)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 6–10

6application · medium
In a packet capture, you see a TCP connection where the client sends a SYN packet, the server responds with SYN-ACK, and the client sends an ACK. Then the client immediately sends a RST packet. What is the most likely explanation?
Select an answer first
7foundation · easy
In a packet capture, an analyst sees a large volume of UDP traffic from an internal host to a single external IP address on port 53, with each packet containing a long string of hexadecimal characters as the query. Which type of activity is most likely indicated?
Select an answer first
8application · medium
You are writing the executive summary of an incident report. What is the most important element to include?
Select an answer first
9application · medium
You are building a timeline of an incident. You have logs from multiple sources with different time zones. What is the best practice to ensure an accurate timeline?
Select an answer first
10foundation · easy
An incident responder is correlating logs from a firewall, an IDS, and a web server. The firewall log shows a connection from an external IP to the web server on port 80, the IDS log shows a signature match for SQL injection, and the web server log shows a request containing 'UNION SELECT' in the URL. What is the most likely conclusion?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Network and Log Investigations GCIH Practice Questions (Page 2)

Questions 6–10

In a packet capture, you see a TCP connection where the client sends a SYN packet, the server responds with SYN-ACK, and the client sends an ACK. Then the client immediately sends a RST packet. What is the most likely explanation?

In a packet capture, an analyst sees a large volume of UDP traffic from an internal host to a single external IP address on port 53, with each packet containing a long string of hexadecimal characters as the query. Which type of activity is most likely indicated?

You are writing the executive summary of an incident report. What is the most important element to include?

You are building a timeline of an incident. You have logs from multiple sources with different time zones. What is the best practice to ensure an accurate timeline?

Keep studying — Incident Response and Investigation