Following a significant security incident, the incident response team is conducting a post-incident review. The team wants to improve future detection and response capabilities. Which action is most aligned with the lessons-learned phase?

Block the attacker's IP addresses at the firewall

Restore all systems from backup

Document the timeline of the incident and identify gaps in detection

Delete all malware samples from the system

What is the primary goal of the containment step in the threat handling process?

To restore systems to normal operation

To remove the threat from affected systems

To identify the root cause of the threat

To limit the spread and impact of the threat

After a security incident, the incident response team conducts a post-incident review. They identify that the intrusion was detected late because the SIEM lacked a correlation rule for the specific attack pattern. Which phase of the incident response lifecycle does this finding primarily relate to, and what should be updated?

Detection and Analysis phase; re-run the SIEM queries

Preparation phase; update the SIEM correlation rules and runbooks

Eradication phase; reimage all affected systems

Containment phase; add more firewall rules

A security operations center (SOC) analyst is reviewing alerts and notices that a workstation has been making outbound connections to a known malicious IP address. The analyst also observes that the workstation's hosts file has been modified to redirect a legitimate banking site to a local IP. Which type of indicator is the modified hosts file?

Behavioral indicator of compromise

Network-based indicator of compromise

Host-based indicator of compromise

In the context of the cyber kill chain, what is the primary purpose of the reconnaissance phase?

To exfiltrate sensitive data from the target network

To deliver the malicious payload to the target system

To gather information about the target that will inform subsequent attack phases

To establish persistence and maintain access to the target environment

GIAC Defending Advanced Threats

Domain 5Objective 1

Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 1)

Part of the Defense and Response domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 7–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 1–5

1application · medium
Following a significant security incident, the incident response team is conducting a post-incident review. The team wants to improve future detection and response capabilities. Which action is most aligned with the lessons-learned phase?
Select an answer first
2foundation · easy
What is the primary goal of the containment step in the threat handling process?
Select an answer first
3application · medium
After a security incident, the incident response team conducts a post-incident review. They identify that the intrusion was detected late because the SIEM lacked a correlation rule for the specific attack pattern. Which phase of the incident response lifecycle does this finding primarily relate to, and what should be updated?
Select an answer first
4application · easy
A security operations center (SOC) analyst is reviewing alerts and notices that a workstation has been making outbound connections to a known malicious IP address. The analyst also observes that the workstation's hosts file has been modified to redirect a legitimate banking site to a local IP. Which type of indicator is the modified hosts file?
Select an answer first
5foundation · easy
In the context of the cyber kill chain, what is the primary purpose of the reconnaissance phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.