During an incident, the response team discovers that an attacker has compromised a web server and is using it to launch attacks against other internal systems. The team needs to contain the threat, but the web server is critical for business operations. Which containment strategy is most appropriate?

Monitor the web server's activity without taking action

Block outbound traffic from the web server to internal systems while keeping it accessible to external users

Disconnect the web server from the network and take it offline

Rebuild the web server from a known-good image

A security analyst notices a series of failed login attempts against the company's VPN gateway from a single external IP address. The attempts are spaced 5 minutes apart and use usernames harvested from a public employee directory. Which type of reconnaissance activity does this pattern best represent?

Initial exploitation to gain unauthorized access

Active reconnaissance to validate credentials and identify valid accounts

Passive reconnaissance by monitoring network traffic

Active scanning of the VPN gateway to identify open ports

What is the primary goal of the eradication phase in incident response?

To isolate the threat to prevent spread

To remove the threat from affected systems

An incident responder is analyzing a compromised host and finds a suspicious scheduled task that runs a PowerShell script every hour. The script downloads and executes a payload from a remote server. The responder needs to confirm the host is compromised and contain the threat. What is the most reliable indicator of compromise and the appropriate containment action?

The scheduled task name is the IOC; disable the scheduled task

The combination of the scheduled task, script, and remote server is the IOC; isolate the host and preserve evidence

The remote server IP is the IOC; block the IP at the firewall

The PowerShell script content is the IOC; delete the script and kill the running process

After containing and eradicating a malware infection, the incident response team is preparing to restore systems from backups. The team wants to ensure that the same attack does not succeed again. Which activity should be performed during the recovery phase?

Conduct a lessons-learned meeting to discuss the incident

Update the incident response plan based on findings

Monitor the network for any signs of re-infection

Patch the vulnerability that was exploited and verify the integrity of restored systems

GIAC Defending Advanced Threats

Domain 5Objective 1

Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 9)

Part of the Defense and Response domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 7–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 41–45

41expert · hard
During an incident, the response team discovers that an attacker has compromised a web server and is using it to launch attacks against other internal systems. The team needs to contain the threat, but the web server is critical for business operations. Which containment strategy is most appropriate?
Select an answer first
42application · medium
A security analyst notices a series of failed login attempts against the company's VPN gateway from a single external IP address. The attempts are spaced 5 minutes apart and use usernames harvested from a public employee directory. Which type of reconnaissance activity does this pattern best represent?
Select an answer first
43foundation · easy
What is the primary goal of the eradication phase in incident response?
Select an answer first
44expert · hard
An incident responder is analyzing a compromised host and finds a suspicious scheduled task that runs a PowerShell script every hour. The script downloads and executes a payload from a remote server. The responder needs to confirm the host is compromised and contain the threat. What is the most reliable indicator of compromise and the appropriate containment action?
Select an answer first
45application · medium
After containing and eradicating a malware infection, the incident response team is preparing to restore systems from backups. The team wants to ensure that the same attack does not succeed again. Which activity should be performed during the recovery phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 9)

Questions 41–45

What is the primary goal of the eradication phase in incident response?

After containing and eradicating a malware infection, the incident response team is preparing to restore systems from backups. The team wants to ensure that the same attack does not succeed again. Which activity should be performed during the recovery phase?

Keep studying — Defense and Response