During a malware investigation, an analyst discovers that the malware deleted several log files on a compromised server. The analyst wants to document this finding for the incident report. What is the most appropriate way to record this information?

Record that the logs were deleted and recommend that the server be immediately rebuilt.

Note that log files were deleted and include the timestamp of discovery and the affected server hostname.

State that the malware intentionally destroyed all evidence of its activity.

Omit the deletion from the report because it does not affect the containment of the malware.

A security operations center is triaging multiple alerts. One alert indicates a possible malware infection on a server that is not critical to business operations. Another alert indicates a phishing email that was opened by a user in the finance department, but no credentials were submitted. Which alert should be prioritized?

The phishing email, because it involves the finance department.

Neither alert, because the team should wait for more information.

The malware infection, because it may spread to other systems.

Both alerts equally, because both require immediate attention.

A company's incident response team has confirmed a ransomware attack that has encrypted critical files. The team is preparing to communicate with stakeholders. Which communication is most appropriate for the IT help desk?

Provide the help desk with a script to answer employee questions about the incident.

Have the help desk escalate all employee questions to the incident response team.

Tell the help desk to avoid discussing the incident with employees until it is resolved.

Instruct the help desk to tell employees that the issue is being handled and no further details are available.

Which activity is a core component of incident assessment?

Identifying affected systems and data

Deploying patches to vulnerable systems

An incident response team has just contained a malware outbreak that affected several servers. The team is preparing to document the incident. Which documentation practice is most important for supporting the post-incident review?

Write a summary of the incident for the company newsletter to inform employees.

Record the exact commands used during containment and the timeline of actions taken.

Document only the final outcome and not the intermediate steps to save time.

Delete all logs that are not directly related to the malware to reduce clutter.

GIAC Cyber Incident Leader

Domain 3Objective 1

Incident Assessment GCIL Practice Questions (Page 7)

Part of the Incident Assessment and Tracking domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

7concepts

Questions 31–35

31application · medium
During a malware investigation, an analyst discovers that the malware deleted several log files on a compromised server. The analyst wants to document this finding for the incident report. What is the most appropriate way to record this information?
Select an answer first
32expert · hard
A security operations center is triaging multiple alerts. One alert indicates a possible malware infection on a server that is not critical to business operations. Another alert indicates a phishing email that was opened by a user in the finance department, but no credentials were submitted. Which alert should be prioritized?
Select an answer first
33application · medium
A company's incident response team has confirmed a ransomware attack that has encrypted critical files. The team is preparing to communicate with stakeholders. Which communication is most appropriate for the IT help desk?
Select an answer first
34foundation · easy
Which activity is a core component of incident assessment?
Select an answer first
35application · medium
An incident response team has just contained a malware outbreak that affected several servers. The team is preparing to document the incident. Which documentation practice is most important for supporting the post-incident review?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.