When prioritizing alerts during triage, which factor should be considered most important?

The number of alerts generated by the same sensor

The ease of investigating the alert

The potential impact on critical business systems

The time of day the alert was generated

Which detection technique is most effective for identifying data exfiltration over DNS?

Monitoring for unusually long or high-volume DNS queries

Checking for open SMB ports on workstations

Reviewing firewall rules for inbound traffic

Analyzing process creation logs for unusual executables

GIAC Enterprise Incident Responder

Domain 3Objective 1

Detecting Modern Attacks GEIR Practice Questions (Page 11)

Part of the Modern Attack Detection domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 51–52

51foundation · easy
When prioritizing alerts during triage, which factor should be considered most important?
Select an answer first
52foundation · easy
Which detection technique is most effective for identifying data exfiltration over DNS?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Detecting Modern Attacks GEIR Practice Questions (Page 11)

Questions 51–52

When prioritizing alerts during triage, which factor should be considered most important?

Which detection technique is most effective for identifying data exfiltration over DNS?

Keep studying — Modern Attack Detection