A company's incident response team is analyzing a ransomware attack and discovers that the attackers exfiltrated sensitive data before encrypting systems, and then threatened to publish the data if the ransom was not paid. This tactic is characteristic of which ransomware family or model?

Double extortion ransomware, such as the REvil/Sodinokibi family

Locker ransomware, such as the WinLocker family

Scareware, such as the FakeAV family

Ransomware-as-a-service (RaaS) model, such as the Maze family

Which of the following is a potential operational impact of a ransomware attack on an organization?

Reduced need for IT support due to automated recovery

Increased customer trust due to enhanced security awareness

Loss of access to critical systems and data, halting business operations

Improved system performance after decryption

Which delivery vector involves an attacker exploiting a vulnerability in a service exposed to the internet?

Remote Desktop Protocol (RDP) compromise

A multinational company has suffered a ransomware attack that encrypted critical systems and exfiltrated sensitive customer data. The company has cyber insurance that covers ransom payments, but the insurer's incident response team recommends paying the ransom to restore operations quickly. The company's legal counsel notes that the data includes personal information of EU residents, and the company has not yet determined whether the attackers have actually exfiltrated the data. The company's board is concerned about reputational damage and wants to minimize downtime. Which approach best balances legal, operational, and reputational considerations?

Notify all affected EU residents immediately about the potential data breach before confirming whether exfiltration occurred.

Pay the ransom immediately because the insurance covers it and the priority is to restore operations and avoid reputational damage.

Refuse to pay the ransom and rely on backups to restore systems, while ignoring the exfiltration threat because backups are intact.

Engage law enforcement and legal counsel to assess the situation, verify the exfiltration claim, and evaluate regulatory notification obligations before deciding on payment.

During a ransomware incident, the incident response team has isolated affected systems and is preparing to recover from backups. Which step should be taken before restoring systems to ensure the ransomware does not re-infect the environment?

Change all user passwords and enforce MFA before restoring systems.

Immediately restore all systems from the most recent backup to minimize downtime.

Identify and eradicate the root cause of the initial infection, such as a phishing email or compromised credentials.

Notify law enforcement before performing any recovery actions.

GIAC Cyber Incident Leader

Domain 1Objective 4

Ransomware Attacks GCIL Practice Questions (Page 1)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 1–5

1application · medium
A company's incident response team is analyzing a ransomware attack and discovers that the attackers exfiltrated sensitive data before encrypting systems, and then threatened to publish the data if the ransom was not paid. This tactic is characteristic of which ransomware family or model?
Select an answer first
2foundation · easy
Which of the following is a potential operational impact of a ransomware attack on an organization?
Select an answer first
3foundation · easy
Which delivery vector involves an attacker exploiting a vulnerability in a service exposed to the internet?
Select an answer first
4expert · hard
A multinational company has suffered a ransomware attack that encrypted critical systems and exfiltrated sensitive customer data. The company has cyber insurance that covers ransom payments, but the insurer's incident response team recommends paying the ransom to restore operations quickly. The company's legal counsel notes that the data includes personal information of EU residents, and the company has not yet determined whether the attackers have actually exfiltrated the data. The company's board is concerned about reputational damage and wants to minimize downtime. Which approach best balances legal, operational, and reputational considerations?
Select an answer first
5application · medium
During a ransomware incident, the incident response team has isolated affected systems and is preparing to recover from backups. Which step should be taken before restoring systems to ensure the ransomware does not re-infect the environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.