During an incident, an analyst identifies malicious activity on a server. Further investigation shows that the attacker used a compromised service account that has administrative privileges on several other servers. What should the analyst do to contain the incident within the identified scope?

Increase logging on the other servers to capture future activity

Isolate the initially compromised server but leave the service account active

Disable the service account and monitor for authentication failures

Reset the service account's password and revoke its access to the other servers

A company uses a hybrid cloud environment. They have full packet capture on the on-premises network but only flow logs in the cloud. During an incident, they suspect that a workload in the cloud is exfiltrating data. What is the most significant limitation they face?

They cannot see the contents of the cloud traffic

They cannot determine which cloud workload is communicating

They cannot see any traffic in the cloud

They cannot correlate cloud traffic with on-premises traffic

Which component is typically responsible for forwarding logs from multiple servers to a central log collector?

A log shipper or forwarder agent

A security team is aggregating logs from multiple sources into a SIEM. They notice that the same user is represented differently in different logs (e.g., 'jsmith', 'JSMITH', 'j.smith'). This is causing them to miss incidents. What is the most effective solution?

Increase the log retention period

Disable logging for sources that use different formats

Implement log normalization and field mapping to standardize user identifiers

Search for all possible variations of the username manually

During an incident, the response team identifies a compromised domain controller. The attacker may have used a golden ticket to access any resource in the domain. The team wants to contain the incident, but they also need to maintain business operations. Which containment strategy best balances security and availability?

Change all user passwords and do not reset krbtgt

Isolate the domain controller from the network but leave it running

Disable the domain controller and rely on read-only domain controllers

Reset the krbtgt account password twice and then rebuild the domain controller

GIAC Enterprise Incident Responder

Domain 1Objective 2

Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 3)

Part of the Incident Response Foundations domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

11concepts

Questions 11–15

11application · medium
During an incident, an analyst identifies malicious activity on a server. Further investigation shows that the attacker used a compromised service account that has administrative privileges on several other servers. What should the analyst do to contain the incident within the identified scope?
Select an answer first
12expert · hard
A company uses a hybrid cloud environment. They have full packet capture on the on-premises network but only flow logs in the cloud. During an incident, they suspect that a workload in the cloud is exfiltrating data. What is the most significant limitation they face?
Select an answer first
13foundation · easy
Which component is typically responsible for forwarding logs from multiple servers to a central log collector?
Select an answer first
14expert · hard
A security team is aggregating logs from multiple sources into a SIEM. They notice that the same user is represented differently in different logs (e.g., 'jsmith', 'JSMITH', 'j.smith'). This is causing them to miss incidents. What is the most effective solution?
Select an answer first
15expert · hard
During an incident, the response team identifies a compromised domain controller. The attacker may have used a golden ticket to access any resource in the domain. The team wants to contain the incident, but they also need to maintain business operations. Which containment strategy best balances security and availability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.