A company has a 10 Gbps internet link and a SIEM that ingests NetFlow and firewall logs. During an incident, the team needs to identify the specific files transferred in a suspected exfiltration. The security budget is limited, and the team cannot afford full packet capture on the entire link. Which approach best balances cost and investigative need?

Enable full packet capture only on the DMZ segment where the suspected server resides

Deploy a network forensic tool that samples every 100th packet on the internet link

Rely on NetFlow and firewall logs to infer the file names from connection metadata

Use the SIEM to reconstruct files from NetFlow records

An incident responder discovers that a malware sample on one host has a network connection to an internal server that is not yet known to be compromised. The responder checks the internal server's logs and finds that it has been sending data to an external IP address. What should the responder do next?

Report the incident as contained to stakeholders

Isolate the internal server without further investigation

Contain the original host and ignore the internal server

Expand the scope to include the internal server and investigate its communications

What is the goal of containment within the identified scope of an incident?

To delete all evidence of the attack

To prevent the attacker from accessing additional systems or data

To restore systems to normal operation immediately

To identify the attacker's identity

An organization discovers malware on a single workstation. The incident response team wants to determine if other hosts were affected. The network has no central logging for DHCP, and workstations are not configured to forward security logs. Which visibility gap is most likely to hinder scoping?

Inability to view DNS queries from workstations

Inability to correlate which IP addresses were assigned to which host at a given time

Inability to perform memory forensics on the infected workstation

Inability to capture full network packets on the core switch

A company uses a cloud environment with virtual networks and virtual machines. During an incident, they need to determine if a virtual machine has been compromised. They have enabled virtual network flow logs and API activity logs. What is the most important additional data source to enable?

Guest OS logs on the virtual machines

DNS logs from the cloud provider

GIAC Enterprise Incident Responder

Domain 1Objective 2

Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 5)

Part of the Incident Response Foundations domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

11concepts

Questions 21–25

21expert · hard
A company has a 10 Gbps internet link and a SIEM that ingests NetFlow and firewall logs. During an incident, the team needs to identify the specific files transferred in a suspected exfiltration. The security budget is limited, and the team cannot afford full packet capture on the entire link. Which approach best balances cost and investigative need?
Select an answer first
22application · medium
An incident responder discovers that a malware sample on one host has a network connection to an internal server that is not yet known to be compromised. The responder checks the internal server's logs and finds that it has been sending data to an external IP address. What should the responder do next?
Select an answer first
23foundation · easy
What is the goal of containment within the identified scope of an incident?
Select an answer first
24application · medium
An organization discovers malware on a single workstation. The incident response team wants to determine if other hosts were affected. The network has no central logging for DHCP, and workstations are not configured to forward security logs. Which visibility gap is most likely to hinder scoping?
Select an answer first
25expert · hard
A company uses a cloud environment with virtual networks and virtual machines. During an incident, they need to determine if a virtual machine has been compromised. They have enabled virtual network flow logs and API activity logs. What is the most important additional data source to enable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 5)

Questions 21–25

What is the goal of containment within the identified scope of an incident?

An organization discovers malware on a single workstation. The incident response team wants to determine if other hosts were affected. The network has no central logging for DHCP, and workstations are not configured to forward security logs. Which visibility gap is most likely to hinder scoping?

A company uses a cloud environment with virtual networks and virtual machines. During an incident, they need to determine if a virtual machine has been compromised. They have enabled virtual network flow logs and API activity logs. What is the most important additional data source to enable?

Keep studying — Incident Response Foundations