An organization discovers that a widely used software library in its applications was compromised by a malicious actor who inserted a backdoor. The organization's incident response team is activated. What is the first priority in the response effort?

Begin forensic analysis of the developer's workstation

Contact the media to issue a public statement

Immediately shut down all internet-facing services

Identify all applications and systems that use the compromised library

An organization is implementing a continuous monitoring program to detect supply chain attacks. Which monitoring activity is most directly focused on detecting a compromised software update?

Monitoring network traffic for unusual outbound connections

Monitoring user activity logs for unusual login times

Monitoring social media for mentions of the organization

Monitoring for unexpected changes in the hash values of critical software files

A small business uses a local IT support company that has remote access to the business's point-of-sale system. The IT support company is compromised, and the attacker uses the support company's remote access tool to install malware on the point-of-sale system. Why is this considered a supply chain attack?

The attacker exploited the trusted relationship between the business and its IT support provider to gain access.

The attacker used a zero-day vulnerability in the point-of-sale system's operating system.

The attacker physically broke into the business's store and installed malware on the point-of-sale system.

The attacker guessed the point-of-sale system's administrator password.

Which of the following is a potential impact of a supply chain attack on system integrity?

Legitimate software is replaced with malicious code that alters system behavior.

Systems become unavailable due to a distributed denial-of-service attack.

Sensitive data is read by an unauthorized party.

The organization's website is defaced with a political message.

A company discovers that a software update for its accounting software, which is distributed by the vendor, contains a Trojan horse. The update was signed with a valid certificate that was stolen from the vendor. Which supply chain attack vector is this?

Hardware implant, because the attacker inserted a malicious chip into the accounting software.

Third-party service vulnerability, because the attacker exploited a vulnerability in the vendor's update service.

Compromised software update, because the attacker tampered with the update and used a stolen certificate to make it appear legitimate.

Insider threat, because the vendor's employee stole the certificate.

GIAC Cyber Incident Leader

Domain 1Objective 5

Supply Chain Attacks GCIL Practice Questions (Page 5)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

5concepts

Questions 21–25

21application · medium
An organization discovers that a widely used software library in its applications was compromised by a malicious actor who inserted a backdoor. The organization's incident response team is activated. What is the first priority in the response effort?
Select an answer first
22application · medium
An organization is implementing a continuous monitoring program to detect supply chain attacks. Which monitoring activity is most directly focused on detecting a compromised software update?
Select an answer first
23application · medium
A small business uses a local IT support company that has remote access to the business's point-of-sale system. The IT support company is compromised, and the attacker uses the support company's remote access tool to install malware on the point-of-sale system. Why is this considered a supply chain attack?
Select an answer first
24foundation · easy
Which of the following is a potential impact of a supply chain attack on system integrity?
Select an answer first
25application · medium
A company discovers that a software update for its accounting software, which is distributed by the vendor, contains a Trojan horse. The update was signed with a valid certificate that was stolen from the vendor. Which supply chain attack vector is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.