Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Why is it important to document the incident scope during an investigation?

   • ATo share technical details only with the incident response team
   • BTo satisfy legal requirements only
   • CTo replace the need for further analysis
   • DTo provide a clear record for stakeholders and support decision-making
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An incident responder is scoping an incident and finds that a compromised account was used to access a file share. The responder then checks the file share's audit logs and finds that multiple files were accessed. The responder also checks the authentication logs and finds that the account was used to log into several servers. What is the most effective way to determine the full scope?

   • ACheck only the most recent log entries
   • BCorrelate the authentication logs with the file access logs to identify all systems and files accessed
   • CFocus only on the file share because that is where the data was accessed
   • DIsolate the account and assume the scope is limited to the file share
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a common visibility gap in enterprise environments?

   • ADNS query logs
   • BFirewall logs
   • CEncrypted network traffic
   • DWindows Security event logs
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is investigating a suspicious connection from an internal workstation to an external IP. The analyst has NetFlow data showing the connection but needs to know which application or process initiated it. Which data source would provide this information?

   • ANetFlow data from the router
   • BDNS logs from the internal DNS server
   • CFirewall logs from the perimeter firewall
   • DEndpoint logs from the workstation (e.g., Sysmon or EDR)
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An analyst is investigating a suspected data breach. The SIEM shows that a user's account was used to access a database at 10:00 AM, and the same account was used to log into a file server at 10:05 AM. The analyst wants to determine if this was the same session or if the attacker used separate sessions. Which data would best clarify this?

   • AThe user's browser history on their workstation
   • BSource IP addresses and authentication timestamps from both logins
   • CThe database's query logs only
   • DThe file server's file access logs only
   Reveal Solution Discussion Select an answer first