You need to collect network traffic evidence from a span port for an ongoing incident. What is the most important consideration to maintain the admissibility of the evidence?

Use a high-end capture appliance

Capture traffic in pcap format and store it on a network share

Capture as much traffic as possible, even if it includes unrelated data

Document the capture start and end times, the capture tool, and the hash of the capture file

You are documenting an incident for a post-incident review. Which information is most important to include to support the timeline and findings?

A list of all employees who were present during the incident.

A list of all software versions in the environment.

A chronological list of events with timestamps, sources, and evidence references.

A summary of the company's stock price during the incident.

You are preparing the final incident report for a breach that involved multiple systems and data exfiltration. You need to present the findings to both technical and non-technical stakeholders. What is the most effective way to structure the report?

Include only the executive summary and omit technical details

Use a single section that mixes technical and non-technical content

Start with an executive summary, then provide technical details in appendices

Provide all technical details first, then summarize at the end

A web server log shows a successful login from an internal user account at 09:15, but the firewall log shows that user's workstation was off the network since 08:00. The VPN log shows an authentication from the same account at 09:10 from an external IP. Which conclusion is most appropriate?

The account was compromised and the VPN authentication is the first sign of malicious activity.

The web server log is falsified and should be disregarded.

The account was used from the VPN, and the web server log is consistent with that remote access.

The workstation was turned on at 09:15 and the web login is legitimate.

You are collecting evidence from a compromised Windows server. The server is still running, and you need to preserve both volatile and non-volatile data. You have limited time and must prioritize. Which order of collection is most appropriate?

Running processes, network connections, disk image, memory dump.

Disk image, memory dump, network connections, running processes.

Network connections, disk image, memory dump, running processes.

Memory dump, network connections, running processes, then disk image.

GIAC Certified Incident Handler

Domain 1Objective 2

Network and Log Investigations GCIH Practice Questions (Page 5)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 21–25

21application · medium
You need to collect network traffic evidence from a span port for an ongoing incident. What is the most important consideration to maintain the admissibility of the evidence?
Select an answer first
22application · medium
You are documenting an incident for a post-incident review. Which information is most important to include to support the timeline and findings?
Select an answer first
23expert · hard
You are preparing the final incident report for a breach that involved multiple systems and data exfiltration. You need to present the findings to both technical and non-technical stakeholders. What is the most effective way to structure the report?
Select an answer first
24application · medium
A web server log shows a successful login from an internal user account at 09:15, but the firewall log shows that user's workstation was off the network since 08:00. The VPN log shows an authentication from the same account at 09:10 from an external IP. Which conclusion is most appropriate?
Select an answer first
25expert · hard
You are collecting evidence from a compromised Windows server. The server is still running, and you need to preserve both volatile and non-volatile data. You have limited time and must prioritize. Which order of collection is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.