An endpoint detection and response (EDR) alert indicates that a workstation is beaconing to an external IP address every 5 minutes. The process responsible is a legitimate system utility that has been abused (living-off-the-land). The analyst needs to confirm the scope of the compromise before taking action. Which step is most appropriate?

Block the external IP at the firewall and close the alert.

Delete the process from the workstation and move on.

Use the EDR to search for the same process and network connections across all endpoints.

Immediately isolate the workstation from the network.

A forensic investigator is handling a case involving a suspected insider threat. The investigator has collected a hard drive image and a memory dump from the suspect's workstation. The case is likely to go to court. Which practice is most critical to ensure the evidence is admissible?

Use the latest forensic tools to analyze the evidence.

Share the evidence with the suspect's legal team immediately.

Maintain a detailed chain of custody document for all evidence.

Store the evidence on a network share for easy access by the legal team.

A company is developing a disaster recovery plan for a ransomware scenario. The security team wants to ensure that restored systems are not immediately re-infected. Which control is most important to include in the recovery process?

Restore from the most recent backup to minimize data loss.

Use the same credentials as before the incident to simplify access.

Reconnect restored systems to the network immediately to resume operations.

Scan all backups for malware before restoration and patch systems before reconnecting to the network.

A SOC analyst is triaging two alerts simultaneously. Alert A is a failed login followed by a successful login for a domain administrator account from a new external IP. Alert B is a single failed login for a standard user account from a known internal IP. The analyst has limited time and must prioritize. Which alert should be escalated first?

Ignore both alerts because login failures are common.

Alert A, because it involves a privileged account and a new external IP, indicating a higher potential impact.

Alert B, because it is a failed login, which is more likely to be an attack.

Escalate both alerts simultaneously because both involve login activity.

GIAC Information Security Professional

Domain 2Objective 2

Security Operations GISP Practice Questions (Page 5)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

12concepts

Questions 21–25

21application · medium
An endpoint detection and response (EDR) alert indicates that a workstation is beaconing to an external IP address every 5 minutes. The process responsible is a legitimate system utility that has been abused (living-off-the-land). The analyst needs to confirm the scope of the compromise before taking action. Which step is most appropriate?
Select an answer first
22expert · hard
A forensic investigator is handling a case involving a suspected insider threat. The investigator has collected a hard drive image and a memory dump from the suspect's workstation. The case is likely to go to court. Which practice is most critical to ensure the evidence is admissible?
Select an answer first
23expert · hard
A company is developing a disaster recovery plan for a ransomware scenario. The security team wants to ensure that restored systems are not immediately re-infected. Which control is most important to include in the recovery process?
Select an answer first
24foundation · easy
In which deployment mode does an intrusion prevention system (IPS) operate?
Select an answer first
25expert · hard
A SOC analyst is triaging two alerts simultaneously. Alert A is a failed login followed by a successful login for a domain administrator account from a new external IP. Alert B is a single failed login for a standard user account from a known internal IP. The analyst has limited time and must prioritize. Which alert should be escalated first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Security Operations GISP Practice Questions (Page 5)

Questions 21–25

A forensic investigator is handling a case involving a suspected insider threat. The investigator has collected a hard drive image and a memory dump from the suspect's workstation. The case is likely to go to court. Which practice is most critical to ensure the evidence is admissible?

A company is developing a disaster recovery plan for a ransomware scenario. The security team wants to ensure that restored systems are not immediately re-infected. Which control is most important to include in the recovery process?

In which deployment mode does an intrusion prevention system (IPS) operate?

Keep studying — Security Architecture and Operations