Incident Handling & Response GSEC Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An incident responder is collecting evidence from a compromised Windows workstation. The workstation is still running, and the responder needs to preserve evidence for a court case. The responder has limited time before the system must be returned to production. Which evidence collection order is MOST appropriate?

   • ACollect memory first, then create a disk image, then collect network logs
   • BPower off the system, then create a disk image, then collect memory
   • CCreate a disk image first, then collect memory, then collect network logs
   • DCollect network logs first, then memory, then create a disk image
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst notices unusual outbound traffic from a server that is not supposed to communicate externally. The analyst suspects a compromise. Which incident handling phase should the analyst formally initiate?

   • AContainment
   • BPreparation
   • CDetection and Triage
   • DEradication
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A medium-sized company has just contained a data breach that exposed customer credit card numbers. The incident response team is preparing to communicate with stakeholders. Which stakeholder group should receive the MOST detailed technical information about the attack vector and compromised systems?

   • AAffected customers
   • BThe company's legal counsel
   • CThe IT security team
   • DThe company's public relations department
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of documenting incident details during the response?

   • ATo provide a marketing opportunity for the organization
   • BTo support post-incident review and legal proceedings
   • CTo increase the workload of the incident response team
   • DTo replace the need for incident response training
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When collecting digital evidence from a compromised system, why is it important to create a forensic image of the storage media rather than simply copying individual files?

   • AA forensic image prevents the system from being powered off
   • BA forensic image preserves deleted files and metadata
   • CA forensic image is smaller and easier to store
   • DA forensic image automatically encrypts the evidence
   Reveal Solution Discussion Select an answer first