An analyst is scoping a phishing incident. The SIEM shows that a user clicked a malicious link and entered credentials. The analyst wants to determine if the attacker used those credentials to access other systems. Which technique is most appropriate?

Correlate authentication logs for the user's account across all systems

Review the user's browser history for other phishing sites

Check the spam filter logs for other emails to the user

Run a vulnerability scan on the user's workstation

During an incident, an analyst finds that a user's account was used to log into a server at 2:00 AM. The analyst then checks the server's security logs and finds that a scheduled task was created at 2:05 AM. The analyst also reviews the firewall logs and sees outbound connections from the server to an external IP at 2:10 AM. What is the most likely sequence of events?

The attacker logged in, created a scheduled task, and then the task initiated outbound connections

The attacker created the scheduled task before logging in

The outbound connections occurred before the login

The login was a false positive and no incident occurred

An incident responder has scoped a breach to 12 servers and 30 workstations. The legal team asks for a report that can be used in court. Which documentation practice is most important for legal admissibility?

Maintaining a chain of custody for all forensic evidence and recording who accessed it and when

Storing the report on the compromised server for convenience

Using technical jargon to demonstrate expertise

Including only the final conclusions without supporting data

A security team is designing visibility for a new office network. They want to detect both network-based threats and host-based threats. Which combination of data sources provides the most comprehensive visibility?

Only full packet capture on the internet gateway

NetFlow from the core switch and Windows Event Logs from endpoints

Firewall logs and DNS logs only

GIAC Enterprise Incident Responder

Domain 1Objective 2

Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 8)

Part of the Incident Response Foundations domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

11concepts

Questions 36–40

36application · medium
An analyst is scoping a phishing incident. The SIEM shows that a user clicked a malicious link and entered credentials. The analyst wants to determine if the attacker used those credentials to access other systems. Which technique is most appropriate?
Select an answer first
37expert · hard
During an incident, an analyst finds that a user's account was used to log into a server at 2:00 AM. The analyst then checks the server's security logs and finds that a scheduled task was created at 2:05 AM. The analyst also reviews the firewall logs and sees outbound connections from the server to an external IP at 2:10 AM. What is the most likely sequence of events?
Select an answer first
38expert · hard
An incident responder has scoped a breach to 12 servers and 30 workstations. The legal team asks for a report that can be used in court. Which documentation practice is most important for legal admissibility?
Select an answer first
39foundation · easy
Which network visibility method provides the most detailed information about the content of network traffic?
Select an answer first
40application · medium
A security team is designing visibility for a new office network. They want to detect both network-based threats and host-based threats. Which combination of data sources provides the most comprehensive visibility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 8)

Questions 36–40

An analyst is scoping a phishing incident. The SIEM shows that a user clicked a malicious link and entered credentials. The analyst wants to determine if the attacker used those credentials to access other systems. Which technique is most appropriate?

An incident responder has scoped a breach to 12 servers and 30 workstations. The legal team asks for a report that can be used in court. Which documentation practice is most important for legal admissibility?

Which network visibility method provides the most detailed information about the content of network traffic?

A security team is designing visibility for a new office network. They want to detect both network-based threats and host-based threats. Which combination of data sources provides the most comprehensive visibility?

Keep studying — Incident Response Foundations