A small law firm has been hit by ransomware twice in the past year, both times through phishing emails. The firm has a limited IT budget and wants to reduce the risk of a third incident. Which combination of controls would be most effective for this firm?

Purchase cyber insurance to cover the cost of a future ransom payment.

Enhance email filtering and provide regular security awareness training to all staff.

Implement multi-factor authentication (MFA) for all remote access and email accounts.

Deploy advanced endpoint detection and response (EDR) on all workstations and servers.

A company wants to improve its resilience against ransomware attacks by ensuring that it can recover data without paying a ransom. Which backup strategy is most effective for this purpose?

Keeping a single copy of backups on a local server that is regularly tested.

Storing backups on the same network as production systems for easy access.

Using cloud backups that are synchronized with production data in real time.

Maintaining immutable, offline backups that are stored separately from the production network.

Which tactic is associated with double extortion ransomware?

Using worm-like self-propagation to spread across networks

Deleting backups before encrypting files

Locking the screen and demanding payment via SMS

Encrypting files and threatening to leak stolen data if the ransom is not paid

During a ransomware incident, the response team discovers that the ransomware was delivered via a drive-by download from a compromised website. The malware then used a known vulnerability in a web browser plugin to gain execution. Which detection technique would have been most likely to alert the team to the initial compromise?

Firewall logs that show the user's browsing history.

Endpoint detection and response (EDR) that monitors for unusual process behavior and exploit attempts.

Network intrusion detection system (IDS) monitoring for suspicious outbound connections.

Antivirus software that scans for known malware signatures.

GIAC Cyber Incident Leader

Domain 1Objective 4

Ransomware Attacks GCIL Practice Questions (Page 4)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 16–20

16application · medium
A mid-sized company is hit by a ransomware variant that not only encrypts files but also exfiltrates sensitive data before encryption. The attackers demand payment and threaten to release the data if the company does not comply. This is an example of which tactic?
Select an answer first
17application · medium
A small law firm has been hit by ransomware twice in the past year, both times through phishing emails. The firm has a limited IT budget and wants to reduce the risk of a third incident. Which combination of controls would be most effective for this firm?
Select an answer first
18application · medium
A company wants to improve its resilience against ransomware attacks by ensuring that it can recover data without paying a ransom. Which backup strategy is most effective for this purpose?
Select an answer first
19foundation · easy
Which tactic is associated with double extortion ransomware?
Select an answer first
20application · medium
During a ransomware incident, the response team discovers that the ransomware was delivered via a drive-by download from a compromised website. The malware then used a known vulnerability in a web browser plugin to gain execution. Which detection technique would have been most likely to alert the team to the initial compromise?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Ransomware Attacks GCIL Practice Questions (Page 4)

Questions 16–20

A mid-sized company is hit by a ransomware variant that not only encrypts files but also exfiltrates sensitive data before encryption. The attackers demand payment and threaten to release the data if the company does not comply. This is an example of which tactic?

A small law firm has been hit by ransomware twice in the past year, both times through phishing emails. The firm has a limited IT budget and wants to reduce the risk of a third incident. Which combination of controls would be most effective for this firm?

A company wants to improve its resilience against ransomware attacks by ensuring that it can recover data without paying a ransom. Which backup strategy is most effective for this purpose?

Which tactic is associated with double extortion ransomware?

Keep studying — Attack Types and Vectors