How do detection findings integrate into incident response processes?

They replace the need for incident response planning

They are stored for forensic analysis only after the incident is closed

They are used only for compliance reporting

They trigger the incident response process and inform containment and remediation actions

A company's security team notices that a server containing sensitive customer data is sending large volumes of data to an external IP address during off-peak hours. The data transfers are encrypted and occur over HTTPS. The team wants to detect if this is data exfiltration. Which detection technique would be most effective in this scenario?

Set an alert for any outbound transfer exceeding a baseline threshold of data volume during off-peak hours

Decrypt all HTTPS traffic using a proxy to inspect the content of the transfers

Block all outbound HTTPS traffic from the server to prevent any potential exfiltration

Monitor the server's CPU and memory usage for spikes during the transfer

Which activity is an example of anti-forensics?

Creating a new user account for persistence

Sending phishing emails to employees

Deleting event logs to remove traces of malicious activity

Using a scheduled task to run malware

An incident responder is analyzing an attack where the attacker used a valid user account to access a file share, then used a tool to dump credentials from memory, and finally transferred a large file to an external server. Which kill chain stages are represented in this attack?

Lateral movement, defense evasion, and actions on objectives

Execution, persistence, and command and control

Initial access, execution, and exfiltration

Initial access, privilege escalation, and exfiltration

GIAC Enterprise Incident Responder

Domain 3Objective 1

Detecting Modern Attacks GEIR Practice Questions (Page 10)

Part of the Modern Attack Detection domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 46–50

46foundation · easy
How do detection findings integrate into incident response processes?
Select an answer first
47application · medium
A company's security team notices that a server containing sensitive customer data is sending large volumes of data to an external IP address during off-peak hours. The data transfers are encrypted and occur over HTTPS. The team wants to detect if this is data exfiltration. Which detection technique would be most effective in this scenario?
Select an answer first
48foundation · easy
Which activity is an example of anti-forensics?
Select an answer first
49foundation · easy
Which technique is used by attackers to hide C2 traffic within legitimate-looking communications?
Select an answer first
50application · medium
An incident responder is analyzing an attack where the attacker used a valid user account to access a file share, then used a tool to dump credentials from memory, and finally transferred a large file to an external server. Which kill chain stages are represented in this attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Detecting Modern Attacks GEIR Practice Questions (Page 10)

Questions 46–50

How do detection findings integrate into incident response processes?

Which activity is an example of anti-forensics?

Which technique is used by attackers to hide C2 traffic within legitimate-looking communications?

An incident responder is analyzing an attack where the attacker used a valid user account to access a file share, then used a tool to dump credentials from memory, and finally transferred a large file to an external server. Which kill chain stages are represented in this attack?

Keep studying — Modern Attack Detection