A company is designing a ransomware prevention strategy. They have a limited budget and must choose between investing in advanced endpoint protection (EDR) or improving their backup and recovery capabilities. The company's leadership is concerned about both prevention and recovery. Which approach is the most balanced?

Invest in EDR only, as it can detect and block ransomware before it encrypts files.

Invest in backups only, as they ensure recovery even if ransomware succeeds.

Split the budget between EDR and backups, prioritizing both prevention and recovery.

Invest in cyber insurance to cover the costs of a ransomware attack.

A manufacturing company experiences a ransomware attack that encrypts its production control systems, causing a shutdown of the assembly line for three days. The company also faces a lawsuit from a business partner whose data was exfiltrated during the attack. Which combination of impacts does this scenario illustrate?

Financial impact only, because the company lost revenue during the shutdown

No significant impact because the company can recover from backups

Operational impact (production downtime) and financial/legal impact (lawsuit)

Reputational impact only, because the company's customers may lose trust

Which preventive control is most effective in reducing the risk of ransomware delivered via phishing emails?

Implementing a password manager

Email filtering and user awareness training

Disabling all internet access for employees

Using only open-source software

A user reports that all their documents, images, and spreadsheets have been renamed with a .encrypted extension and cannot be opened. The user also sees a text file on the desktop with instructions to pay a ransom to get a decryption key. Which type of ransomware is most likely involved?

Locker ransomware, which locks the user out of the system.

Scareware, which displays fake alerts to trick users into paying.

A remote access trojan (RAT) that deleted the files.

Encrypting ransomware, which encrypts files and demands payment for decryption.

What is a defining characteristic of ransomware-as-a-service (RaaS)?

Ransomware is delivered exclusively through cloud-based email services

Ransomware is sold or leased to affiliates who conduct attacks for a share of the ransom

Ransomware is designed to target only cloud-based infrastructure

Ransomware is automatically deployed without any human involvement

GIAC Cyber Incident Leader

Domain 1Objective 4

Ransomware Attacks GCIL Practice Questions (Page 7)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 31–35

31expert · hard
A company is designing a ransomware prevention strategy. They have a limited budget and must choose between investing in advanced endpoint protection (EDR) or improving their backup and recovery capabilities. The company's leadership is concerned about both prevention and recovery. Which approach is the most balanced?
Select an answer first
32application · medium
A manufacturing company experiences a ransomware attack that encrypts its production control systems, causing a shutdown of the assembly line for three days. The company also faces a lawsuit from a business partner whose data was exfiltrated during the attack. Which combination of impacts does this scenario illustrate?
Select an answer first
33foundation · easy
Which preventive control is most effective in reducing the risk of ransomware delivered via phishing emails?
Select an answer first
34application · medium
A user reports that all their documents, images, and spreadsheets have been renamed with a .encrypted extension and cannot be opened. The user also sees a text file on the desktop with instructions to pay a ransom to get a decryption key. Which type of ransomware is most likely involved?
Select an answer first
35foundation · easy
What is a defining characteristic of ransomware-as-a-service (RaaS)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Ransomware Attacks GCIL Practice Questions (Page 7)

Questions 31–35

Which preventive control is most effective in reducing the risk of ransomware delivered via phishing emails?

A user reports that all their documents, images, and spreadsheets have been renamed with a .encrypted extension and cannot be opened. The user also sees a text file on the desktop with instructions to pay a ransom to get a decryption key. Which type of ransomware is most likely involved?

What is a defining characteristic of ransomware-as-a-service (RaaS)?

Keep studying — Attack Types and Vectors