A company has suffered a ransomware attack that encrypted its systems and exfiltrated customer data. The company's legal counsel advises that the data breach notification law in the company's jurisdiction requires notification to affected individuals within 72 hours of discovery. The company's incident response team is still investigating the scope of the breach and has not confirmed which specific records were exfiltrated. The company's board is concerned about the reputational impact of a premature notification. Which action best balances legal compliance and reputational risk?

Notify affected individuals within the required timeframe based on the best available information, while continuing to investigate the full scope.

Notify the public immediately without waiting for the investigation to complete.

Delay notification until the full scope of the breach is confirmed to avoid reputational damage.

Pay the ransom to prevent the publication of data and avoid the need for notification.

Which definition best describes ransomware?

A network attack that overwhelms a service with traffic to make it unavailable

A type of phishing attack that tricks users into revealing personal information

Software that steals credentials and exfiltrates sensitive data without user awareness

Malware that encrypts files or blocks system access and demands payment for restoration

A company's incident response team is responding to a ransomware attack. They have isolated the affected systems and are preparing to recover from backups. However, they discover that the backups are also encrypted because the backup server was compromised. The company has no other recovery options. Which action should the incident response team take next?

Pay the ransom immediately because there are no other options.

Engage law enforcement and consider negotiating with the attackers to obtain a decryption key, while also exploring any available decryption tools from security vendors.

Restore from the encrypted backups by removing the encryption.

Shut down all systems and wait for the attackers to release a decryption key.

A company's security team notices that an attacker has been using a compromised RDP account to access a server and deploy ransomware. Which preventive control would have most likely prevented this attack?

Deploying an email filtering solution to block phishing emails.

Implementing a backup strategy with offline backups.

Conducting user awareness training on phishing.

Enforcing multi-factor authentication (MFA) on all RDP connections.

Which of the following is a detection technique that can help identify ransomware activity early in an attack?

Waiting for users to report that files are inaccessible

Checking email logs for phishing attempts

Monitoring for unusual file encryption activity or mass file renames

Reviewing firewall logs for outbound traffic to known command-and-control servers

GIAC Cyber Incident Leader

Domain 1Objective 4

Ransomware Attacks GCIL Practice Questions (Page 9)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 41–45

41expert · hard
A company has suffered a ransomware attack that encrypted its systems and exfiltrated customer data. The company's legal counsel advises that the data breach notification law in the company's jurisdiction requires notification to affected individuals within 72 hours of discovery. The company's incident response team is still investigating the scope of the breach and has not confirmed which specific records were exfiltrated. The company's board is concerned about the reputational impact of a premature notification. Which action best balances legal compliance and reputational risk?
Select an answer first
42foundation · easy
Which definition best describes ransomware?
Select an answer first
43expert · hard
A company's incident response team is responding to a ransomware attack. They have isolated the affected systems and are preparing to recover from backups. However, they discover that the backups are also encrypted because the backup server was compromised. The company has no other recovery options. Which action should the incident response team take next?
Select an answer first
44application · medium
A company's security team notices that an attacker has been using a compromised RDP account to access a server and deploy ransomware. Which preventive control would have most likely prevented this attack?
Select an answer first
45foundation · easy
Which of the following is a detection technique that can help identify ransomware activity early in an attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Ransomware Attacks GCIL Practice Questions (Page 9)

Questions 41–45

Which definition best describes ransomware?

A company's security team notices that an attacker has been using a compromised RDP account to access a server and deploy ransomware. Which preventive control would have most likely prevented this attack?

Which of the following is a detection technique that can help identify ransomware activity early in an attack?

Keep studying — Attack Types and Vectors