A security team has a mature EDR solution but is struggling with attackers who use fileless malware that runs in memory and disables event logging. The team wants to improve detection without disrupting business operations. Which approach best balances detection coverage with operational impact?

Use a combination of PowerShell logging, AMSI, and behavioral analytics to detect suspicious in-memory activity.

Enable PowerShell script block logging and constrained language mode on all endpoints.

Deploy a kernel-level sensor that monitors memory for known malicious patterns.

Disable Windows Script Host and restrict all scripting languages on endpoints.

What is a common indicator of command and control (C2) beaconing?

High CPU usage on a single workstation

Multiple failed login attempts to a domain controller

A sudden increase in inbound email traffic

Regular, periodic outbound connections to a remote host at consistent intervals

GIAC Enterprise Incident Responder

Domain 3Objective 1

Detecting Modern Attacks GEIR Practice Questions (Page 7)

Part of the Modern Attack Detection domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 31–35

31foundation · easy
Which technique is commonly used for initial access in modern attacks?
Select an answer first
32expert · hard
A security team has a mature EDR solution but is struggling with attackers who use fileless malware that runs in memory and disables event logging. The team wants to improve detection without disrupting business operations. Which approach best balances detection coverage with operational impact?
Select an answer first
33foundation · easy
What is a common indicator of command and control (C2) beaconing?
Select an answer first
34foundation · easy
In the Cyber Kill Chain model, which stage follows 'Weaponization'?
Select an answer first
35foundation · easy
Which technique is used by attackers to evade security controls?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Detecting Modern Attacks GEIR Practice Questions (Page 7)

Questions 31–35

Which technique is commonly used for initial access in modern attacks?

A security team has a mature EDR solution but is struggling with attackers who use fileless malware that runs in memory and disables event logging. The team wants to improve detection without disrupting business operations. Which approach best balances detection coverage with operational impact?

What is a common indicator of command and control (C2) beaconing?

In the Cyber Kill Chain model, which stage follows 'Weaponization'?

Which technique is used by attackers to evade security controls?

Keep studying — Modern Attack Detection