What is the primary purpose of a post-incident review (lessons learned)?

To document the incident for legal purposes only

To identify what went well and what can be improved

To delete all evidence related to the incident

A security team is developing an incident response plan. They want to ensure that lessons learned from past incidents are incorporated into future detection and response. Which activity best supports this goal?

Increasing the frequency of security awareness training

Conducting a post-incident review after every significant incident

What is the primary objective of a containment strategy?

To restore systems to normal operation

To identify the attacker's identity

To limit the damage and prevent the threat from spreading

To eliminate the threat from the environment

Which of the following is an example of an indicator of compromise (IOC)?

A standard software update notification

A company's public financial report

What is the primary purpose of analyzing indicators of compromise (IOCs)?

To improve employee productivity

To identify and respond to potential security incidents

GIAC Defending Advanced Threats

Domain 5Objective 1

Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 3)

Part of the Defense and Response domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 7–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 11–15

11foundation · easy
What is the primary purpose of a post-incident review (lessons learned)?
Select an answer first
12application · medium
A security team is developing an incident response plan. They want to ensure that lessons learned from past incidents are incorporated into future detection and response. Which activity best supports this goal?
Select an answer first
13foundation · easy
What is the primary objective of a containment strategy?
Select an answer first
14foundation · easy
Which of the following is an example of an indicator of compromise (IOC)?
Select an answer first
15foundation · easy
What is the primary purpose of analyzing indicators of compromise (IOCs)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.