After a ransomware attack, the incident response team has restored all systems from backups. However, the team is concerned that the attacker may have exfiltrated data before the ransomware was deployed. Which action should be taken to address this concern?

Notify law enforcement immediately

Change all passwords and enforce multi-factor authentication

Monitor the network for any signs of the attacker's return

Conduct a thorough forensic analysis of the backups to identify any traces of the attacker's activity

Following a major incident, the incident response team is preparing a report for senior management. The report must be concise and actionable. Which information is most important to include?

A detailed technical timeline of every event

The business impact, root cause, and recommended improvements

The names of all employees involved in the incident

The exact malware hash and C2 domains

During incident response, a security team identifies a malicious PowerShell script running on a critical file server. The script is downloading additional payloads from a command-and-control server. The team needs to stop the immediate threat while preserving evidence for forensic analysis. What should the team do FIRST?

Run an antivirus scan on the file server

Capture a memory dump and network connections before taking action

Kill the PowerShell process immediately

Disconnect the file server from the network

An analyst is reviewing a set of indicators that include a file hash, a domain name, and an IP address. The analyst wants to determine if these indicators are related to a known threat group. Which source of threat intelligence would be most useful?

A network monitoring tool that captures traffic

A vulnerability database that lists CVEs

A threat intelligence platform that correlates indicators with known adversary groups

GIAC Defending Advanced Threats

Domain 5Objective 1

Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 6)

Part of the Defense and Response domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 7–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 26–30

26expert · hard
After a ransomware attack, the incident response team has restored all systems from backups. However, the team is concerned that the attacker may have exfiltrated data before the ransomware was deployed. Which action should be taken to address this concern?
Select an answer first
27expert · medium
Following a major incident, the incident response team is preparing a report for senior management. The report must be concise and actionable. Which information is most important to include?
Select an answer first
28application · medium
During incident response, a security team identifies a malicious PowerShell script running on a critical file server. The script is downloading additional payloads from a command-and-control server. The team needs to stop the immediate threat while preserving evidence for forensic analysis. What should the team do FIRST?
Select an answer first
29application · easy
An incident response team has detected a malware infection on a critical server. The team has isolated the server and collected forensic evidence. The team now needs to remove the malware and restore the server to normal operation. Which phase of the threat handling process does this represent?
Select an answer first
30expert · medium
An analyst is reviewing a set of indicators that include a file hash, a domain name, and an IP address. The analyst wants to determine if these indicators are related to a known threat group. Which source of threat intelligence would be most useful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 6)

Questions 26–30

After a ransomware attack, the incident response team has restored all systems from backups. However, the team is concerned that the attacker may have exfiltrated data before the ransomware was deployed. Which action should be taken to address this concern?

Following a major incident, the incident response team is preparing a report for senior management. The report must be concise and actionable. Which information is most important to include?

An incident response team has detected a malware infection on a critical server. The team has isolated the server and collected forensic evidence. The team now needs to remove the malware and restore the server to normal operation. Which phase of the threat handling process does this represent?

An analyst is reviewing a set of indicators that include a file hash, a domain name, and an IP address. The analyst wants to determine if these indicators are related to a known threat group. Which source of threat intelligence would be most useful?

Keep studying — Defense and Response