An organization's endpoints are infected with ransomware that encrypts files and spreads through network shares. The EPP has detected the ransomware but cannot stop it from spreading. The organization wants to contain the infection and prevent further spread. Which action should be taken first?

Disconnect infected endpoints from the network and block the ransomware's command-and-control (C2) domains at the firewall.

Run a full antivirus scan on all endpoints and wait for results.

Restore all files from backup immediately.

Change all user passwords immediately.

What does the principle of least privilege state?

All users should have the same level of access to simplify management

Access should be granted based on the user's seniority

Administrators should have full access to all systems

Users should have the minimum level of access necessary to perform their job functions

What is the primary purpose of vulnerability scanning?

To identify known weaknesses in systems and applications

A company must protect sensitive data in a database that is accessed by multiple applications. Some applications need to query the data, while others only need to store it. The company wants to ensure that even if the database server is compromised, the data remains unreadable. Which approach best meets this requirement?

Use application-level encryption so that the database stores only ciphertext, and applications decrypt data only when needed.

Rely on the database's built-in access controls.

Encrypt the database backup files only.

Use transparent data encryption (TDE) at the database level.

A security team subscribes to a threat intelligence feed that provides indicators of compromise (IOCs) for a new ransomware campaign. The team wants to use this intelligence to proactively defend their environment. Which action best applies this threat intelligence?

Share the IOCs only with the executive team.

Ignore the feed because ransomware is not a threat to the company.

Store the IOCs in a spreadsheet for future reference.

Update firewall and endpoint detection rules to block the IOCs and search logs for any matches.

GIAC Information Security Fundamentals

Domain 3Objective 4

Defensive Technologies and Emerging Intelligence GISF Practice Questions (Page 7)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 31–35

31expert · hard
An organization's endpoints are infected with ransomware that encrypts files and spreads through network shares. The EPP has detected the ransomware but cannot stop it from spreading. The organization wants to contain the infection and prevent further spread. Which action should be taken first?
Select an answer first
32foundation · easy
What does the principle of least privilege state?
Select an answer first
33foundation · easy
What is the primary purpose of vulnerability scanning?
Select an answer first
34expert · hard
A company must protect sensitive data in a database that is accessed by multiple applications. Some applications need to query the data, while others only need to store it. The company wants to ensure that even if the database server is compromised, the data remains unreadable. Which approach best meets this requirement?
Select an answer first
35application · medium
A security team subscribes to a threat intelligence feed that provides indicators of compromise (IOCs) for a new ransomware campaign. The team wants to use this intelligence to proactively defend their environment. Which action best applies this threat intelligence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.