A critical application server is compromised, and the attacker is actively using it to pivot to other systems. The server cannot be taken offline because it supports a live production process that would cause significant financial loss. What is the most appropriate containment approach?

Immediately power off the server to stop the attack, accepting the financial loss.

Implement network-level access controls to block the server's communication with other systems while allowing it to continue serving its primary function.

Disconnect the server from the network entirely, even though it stops the application.

Leave the server fully connected and monitor the attacker's actions for intelligence.

During an active ransomware attack, the incident response team needs to prevent the malware from encrypting more files while preserving evidence for forensic analysis. Which containment action best achieves this?

Power off all affected systems immediately to stop the encryption.

Run a full antivirus scan on the affected systems before isolating them.

Isolate affected systems from the network while keeping them powered on to preserve volatile memory.

Disconnect only the internet connection but leave internal network access intact.

Which output is a typical result of the lessons-learned process?

A summary of the incident for marketing purposes

A list of recommended improvements to the incident response plan

A final invoice for incident response services

The incident response team has completed all technical actions for an incident. Before formally closing the incident, what should the incident commander verify?

That the incident commander has approved the final report without review.

That all closure criteria defined in the incident response plan have been met and documented.

That all affected users have been notified of the incident details.

That the incident has been open for at least 30 days to ensure no recurrence.

GIAC Cyber Incident Leader

Domain 4Objective 1

Incident Remediation and Closure GCIL Practice Questions (Page 1)

Part of the Incident Response and Remediation domain, which makes up ~6% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~3–5 in this domain), expect 3–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 1–5

1expert · hard
A critical application server is compromised, and the attacker is actively using it to pivot to other systems. The server cannot be taken offline because it supports a live production process that would cause significant financial loss. What is the most appropriate containment approach?
Select an answer first
2application · medium
During an active ransomware attack, the incident response team needs to prevent the malware from encrypting more files while preserving evidence for forensic analysis. Which containment action best achieves this?
Select an answer first
3foundation · easy
Which output is a typical result of the lessons-learned process?
Select an answer first
4foundation · easy
During an incident, the response team has identified a malicious process running on several servers. Which remediation strategy directly targets the removal of the threat from the affected systems?
Select an answer first
5application · medium
The incident response team has completed all technical actions for an incident. Before formally closing the incident, what should the incident commander verify?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.