During an incident, an analyst needs to determine whether a specific executable ran on a set of Windows endpoints. The endpoints have EDR agents installed, but the EDR console only shows alerts, not a full process execution history. Which additional data source would best help confirm execution?

DNS query logs from the internal DNS server

Network flow logs from the internal router

Windows Event Logs (Security 4688) from the endpoints

Vulnerability scan results from the last quarter

When communicating incident scope to non-technical stakeholders, what is the most effective approach?

Use non-technical language and focus on business impact

Withhold information until the investigation is complete

Provide raw log excerpts and technical details

Only communicate through written reports

An incident responder is scoping a breach that may have started six months ago. The organization retains Windows Security logs for 90 days and firewall logs for one year. The attacker is believed to have used a valid account. Which limitation is most likely to prevent a complete scope determination?

The 90-day retention of Windows Security logs means authentication events older than 90 days are unavailable

The attacker's valid account would not generate any logs

The SIEM cannot correlate logs from different time zones

Firewall logs do not contain authentication event details

What is the primary purpose of log normalization in a centralized log management system?

To convert logs from various sources into a common format for analysis

To reduce the storage size of logs

To delete duplicate log entries

An incident responder has completed the initial scoping of a malware outbreak. Management asks for a summary of which systems are affected and what evidence supports that conclusion. What is the most appropriate way to document the scope?

A summary of the attacker's likely motivation and attribution

A verbal briefing with no written record to avoid leaking sensitive details

A list of all IP addresses in the organization's network, marked as potentially affected

A table listing each affected host, the indicator of compromise (IOC) observed, and the timestamp of first and last activity

GIAC Enterprise Incident Responder

Domain 1Objective 2

Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 4)

Part of the Incident Response Foundations domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

11concepts

Questions 16–20

16application · medium
During an incident, an analyst needs to determine whether a specific executable ran on a set of Windows endpoints. The endpoints have EDR agents installed, but the EDR console only shows alerts, not a full process execution history. Which additional data source would best help confirm execution?
Select an answer first
17foundation · easy
When communicating incident scope to non-technical stakeholders, what is the most effective approach?
Select an answer first
18expert · hard
An incident responder is scoping a breach that may have started six months ago. The organization retains Windows Security logs for 90 days and firewall logs for one year. The attacker is believed to have used a valid account. Which limitation is most likely to prevent a complete scope determination?
Select an answer first
19foundation · easy
What is the primary purpose of log normalization in a centralized log management system?
Select an answer first
20application · medium
An incident responder has completed the initial scoping of a malware outbreak. Management asks for a summary of which systems are affected and what evidence supports that conclusion. What is the most appropriate way to document the scope?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.