What is the immediate priority when responding to a confirmed data exfiltration incident?

Contain the threat to stop further data loss

Delete all logs to prevent attacker access

Rebuild all systems from scratch immediately

Notify the public before internal stakeholders

After detecting a data exfiltration incident, the incident response team needs to preserve evidence for potential legal action. Which action is most critical to ensure the evidence is admissible?

Create a forensic image of the affected systems using write-blockers and document the chain of custody.

Run a full antivirus scan on the affected systems to clean any malware.

Copy all relevant files to a shared network drive for easy access by the legal team.

Take screenshots of the suspicious network traffic logs.

Which log source would most directly reveal an attacker compressing files before exfiltration?

Firewall logs showing allowed inbound connections

Operating system logs showing the execution of archiving utilities

DNS logs showing queries to a public resolver

Email logs showing messages sent to internal recipients

GIAC Defending Advanced Threats

Domain 4Objective 1

Data Exfiltration GDAT Practice Questions (Page 3)

Part of the Exfiltration and Emulation domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 5–8 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 11–15

11foundation · easy
What is the immediate priority when responding to a confirmed data exfiltration incident?
Select an answer first
12application · medium
After detecting a data exfiltration incident, the incident response team needs to preserve evidence for potential legal action. Which action is most critical to ensure the evidence is admissible?
Select an answer first
13foundation · easy
Which log source would most directly reveal an attacker compressing files before exfiltration?
Select an answer first
14application · medium
A security team is investigating a possible data breach. They find that a large amount of data was transferred to an external IP address using a protocol that is not typically allowed outbound. The traffic was fragmented and used non-standard port numbers. What exfiltration technique does this describe?
Select an answer first
15application · medium
A security analyst notices that a user's workstation is sending a large volume of data to a cloud storage service during off-hours. The user has no legitimate business need for that service. The data transfers are encrypted and appear to be using the service's API. What is the most likely exfiltration technique being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Data Exfiltration GDAT Practice Questions (Page 3)

Questions 11–15

What is the immediate priority when responding to a confirmed data exfiltration incident?

After detecting a data exfiltration incident, the incident response team needs to preserve evidence for potential legal action. Which action is most critical to ensure the evidence is admissible?

Which log source would most directly reveal an attacker compressing files before exfiltration?

Keep studying — Exfiltration and Emulation