During an incident response, a security analyst discovers that a compromised workstation has been communicating with a known malicious IP address and that a suspicious DLL was dropped in the user's startup folder. Which two items are best classified as indicators of compromise (IoCs)?

The malicious IP address and the suspicious DLL hash

The attacker's motivation and the victim's industry

The incident response plan and the business impact analysis

The MITRE ATT&CK technique ID and the attack vector

What is an indicator of compromise (IoC)?

A piece of forensic evidence that suggests a system has been compromised

A firewall log entry showing allowed traffic

A security analyst is investigating a breach and observes that the attacker used a previously unknown exploit for a zero-day vulnerability, exfiltrated data via encrypted DNS tunneling, and left no malware on disk. The analyst wants to structure the analysis to understand the adversary's behavior and improve future detection. Which framework should the analyst use, and what is the primary benefit?

MITRE ATT&CK; map observed behaviors to techniques to identify gaps in detection coverage

Cyber Kill Chain; determine the attacker's motivation and intent

DREAD; calculate the risk score of the zero-day exploit

Attack trees; identify the root cause of the vulnerability

Why is attributing a cyber attack to a specific actor often difficult?

Attribution is always straightforward because of digital fingerprints

Attackers can use proxies, anonymization, and false flags to hide their identity

Most attacks are carried out by automated bots with no human involvement

Law enforcement agencies do not have the technical capability to trace attacks

GIAC Information Security Fundamentals

Domain 3Objective 1

Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 6)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 26–30

26foundation · easy
Which framework provides a knowledge base of adversary tactics and techniques based on real-world observations?
Select an answer first
27application · medium
During an incident response, a security analyst discovers that a compromised workstation has been communicating with a known malicious IP address and that a suspicious DLL was dropped in the user's startup folder. Which two items are best classified as indicators of compromise (IoCs)?
Select an answer first
28foundation · easy
What is an indicator of compromise (IoC)?
Select an answer first
29expert · hard
A security analyst is investigating a breach and observes that the attacker used a previously unknown exploit for a zero-day vulnerability, exfiltrated data via encrypted DNS tunneling, and left no malware on disk. The analyst wants to structure the analysis to understand the adversary's behavior and improve future detection. Which framework should the analyst use, and what is the primary benefit?
Select an answer first
30foundation · easy
Why is attributing a cyber attack to a specific actor often difficult?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 6)

Questions 26–30

Which framework provides a knowledge base of adversary tactics and techniques based on real-world observations?

During an incident response, a security analyst discovers that a compromised workstation has been communicating with a known malicious IP address and that a suspicious DLL was dropped in the user's startup folder. Which two items are best classified as indicators of compromise (IoCs)?

What is an indicator of compromise (IoC)?

Why is attributing a cyber attack to a specific actor often difficult?

Keep studying — Threats and Defenses