An organization has detected an active attacker on its network. The attacker has compromised a file server and is using it to move laterally. The organization's primary concern is business continuity, but it also wants to preserve evidence for potential legal action. Which containment strategy balances these concerns?

Shut down the file server to prevent further access

Leave the file server online and monitor the attacker's activity

Isolate the file server while maintaining a network tap for monitoring

Disconnect the file server from the network immediately

After containing a malware infection on a server, the incident response team needs to eradicate the threat and restore the system to normal operation. The malware is known to have modified system files and created a scheduled task. Which sequence of actions is most appropriate?

Reimage the server from a known-good backup and then verify the scheduled task is gone

Delete the scheduled task and run an antivirus scan

Disconnect the server and leave it powered off

Restore the server from the latest backup, which may contain the malware

During an incident, the response team discovers that an attacker has compromised a domain controller and is using it to authenticate to multiple servers. The team needs to limit the attacker's movement while keeping the domain operational for business continuity. Which containment strategy is most appropriate?

Reset the compromised account's password and enforce multi-factor authentication

Rebuild the domain controller from backup

Disconnect the domain controller from the network immediately

Block all outbound traffic from the domain controller

During triage of a suspected intrusion, an analyst identifies a PowerShell script on a domain controller that is beaconing to an external IP every 5 minutes. The script is running as SYSTEM and has modified several registry Run keys. The incident response team needs to stop the immediate impact while preserving evidence for forensic analysis. Which action should be taken first?

Terminate the PowerShell process and delete the script from disk.

Disable the registry Run keys and schedule a reboot during the next maintenance window.

Rebuild the domain controller from a known-good image immediately.

Block the external IP at the perimeter firewall and isolate the domain controller from the network.

GIAC Defending Advanced Threats

Domain 5Objective 1

Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 7)

Part of the Defense and Response domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 7–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 31–35

31expert · hard
An organization has detected an active attacker on its network. The attacker has compromised a file server and is using it to move laterally. The organization's primary concern is business continuity, but it also wants to preserve evidence for potential legal action. Which containment strategy balances these concerns?
Select an answer first
32application · medium
After containing a malware infection on a server, the incident response team needs to eradicate the threat and restore the system to normal operation. The malware is known to have modified system files and created a scheduled task. Which sequence of actions is most appropriate?
Select an answer first
33application · medium
During an incident, the response team discovers that an attacker has compromised a domain controller and is using it to authenticate to multiple servers. The team needs to limit the attacker's movement while keeping the domain operational for business continuity. Which containment strategy is most appropriate?
Select an answer first
34application · medium
During triage of a suspected intrusion, an analyst identifies a PowerShell script on a domain controller that is beaconing to an external IP every 5 minutes. The script is running as SYSTEM and has modified several registry Run keys. The incident response team needs to stop the immediate impact while preserving evidence for forensic analysis. Which action should be taken first?
Select an answer first
35foundation · easy
In the structured threat handling process, which step immediately follows detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 7)

Questions 31–35

After containing a malware infection on a server, the incident response team needs to eradicate the threat and restore the system to normal operation. The malware is known to have modified system files and created a scheduled task. Which sequence of actions is most appropriate?

In the structured threat handling process, which step immediately follows detection?

Keep studying — Defense and Response