An organization wants to reduce the risk of data exfiltration through removable media. They have a mix of managed and unmanaged workstations. Which control would be most effective across both types?

Create a group policy to disable removable media write access.

Disable USB ports via BIOS settings on all workstations.

Implement a DLP policy that blocks data transfers to removable media on all endpoints.

Physically remove USB ports from all workstations.

Which practice is an effective access restriction to reduce the risk of data exfiltration?

Granting all employees administrator rights to their workstations

Implementing the principle of least privilege for data access

Disabling all firewall rules to simplify network traffic

Allowing unrestricted USB device usage for all staff

A security analyst is reviewing proxy logs and notices that a user is accessing a file-sharing website and uploading files with names that match internal project codes. The uploads occur during business hours and the user has a legitimate role that involves sharing files with external partners. What is the most appropriate next step?

Treat this as a potential data exfiltration incident and escalate to the incident response team.

Immediately block the user's access to the file-sharing website.

Ignore the activity because the user has a legitimate role.

Investigate the user's activity and verify whether the uploads are authorized by policy.

An organization has just discovered that a malicious insider has been exfiltrating sensitive data via email over the past month. The insider has already left the company. The organization wants to prevent future incidents and also preserve evidence for potential legal action. What is the best course of action?

Immediately delete the insider's email account and all associated data.

Change the email gateway rules to block all outbound email with attachments.

Preserve the email account and mailbox, then conduct a forensic analysis to determine the scope of the exfiltration.

Inform law enforcement immediately without preserving evidence.

Which control is specifically designed to prevent sensitive data from being transmitted outside the organization?

Data Loss Prevention (DLP) system

Intrusion Detection System (IDS)

GIAC Defending Advanced Threats

Domain 4Objective 1

Data Exfiltration GDAT Practice Questions (Page 6)

Part of the Exfiltration and Emulation domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 5–8 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 26–30

26application · medium
An organization wants to reduce the risk of data exfiltration through removable media. They have a mix of managed and unmanaged workstations. Which control would be most effective across both types?
Select an answer first
27foundation · easy
Which practice is an effective access restriction to reduce the risk of data exfiltration?
Select an answer first
28application · medium
A security analyst is reviewing proxy logs and notices that a user is accessing a file-sharing website and uploading files with names that match internal project codes. The uploads occur during business hours and the user has a legitimate role that involves sharing files with external partners. What is the most appropriate next step?
Select an answer first
29expert · hard
An organization has just discovered that a malicious insider has been exfiltrating sensitive data via email over the past month. The insider has already left the company. The organization wants to prevent future incidents and also preserve evidence for potential legal action. What is the best course of action?
Select an answer first
30foundation · easy
Which control is specifically designed to prevent sensitive data from being transmitted outside the organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Data Exfiltration GDAT Practice Questions (Page 6)

Questions 26–30

An organization wants to reduce the risk of data exfiltration through removable media. They have a mix of managed and unmanaged workstations. Which control would be most effective across both types?

Which practice is an effective access restriction to reduce the risk of data exfiltration?

Which control is specifically designed to prevent sensitive data from being transmitted outside the organization?

Keep studying — Exfiltration and Emulation