After a major security incident, the incident response team conducts a post-incident review. The team identifies that the incident was prolonged because the on-call analyst did not have access to the necessary log management tools. Which action should the team take to prevent this issue in the future?

Provide the on-call analyst with the necessary access and training on the log management tools.

Require all incidents to be escalated to the senior incident response team.

Update the incident response plan to include a checklist for log access.

Purchase additional log management tools to improve detection capabilities.

A security analyst discovers that an employee's workstation has been compromised and may contain evidence of data exfiltration. The company plans to pursue legal action against the employee. Which action is MOST important to ensure the evidence is admissible in court?

Run a full antivirus scan on the workstation

Copy the relevant files to a USB drive

Take screenshots of the suspicious files

Create a forensic image of the hard drive using a write-blocker

A company has just finished eradicating a ransomware infection from all affected servers and restored data from backups. The incident response team is now meeting to discuss what went well and what could be improved. According to the incident handling phases, which activity should occur next?

Declare the incident closed and archive all evidence.

Begin monitoring the network for signs of reinfection.

Conduct a lessons-learned review and update the incident response plan.

Restore the remaining systems that were not yet recovered.

GIAC Security Essentials

Domain 5Objective 1

Incident Handling & Response GSEC Practice Questions (Page 2)

Part of the Security Operations and Incident Response domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 6–10

6application · medium
After a major security incident, the incident response team conducts a post-incident review. The team identifies that the incident was prolonged because the on-call analyst did not have access to the necessary log management tools. Which action should the team take to prevent this issue in the future?
Select an answer first
7application · medium
A security analyst discovers that an employee's workstation has been compromised and may contain evidence of data exfiltration. The company plans to pursue legal action against the employee. Which action is MOST important to ensure the evidence is admissible in court?
Select an answer first
8application · medium
A company has just finished eradicating a ransomware infection from all affected servers and restored data from backups. The incident response team is now meeting to discuss what went well and what could be improved. According to the incident handling phases, which activity should occur next?
Select an answer first
9foundation · easy
An organization has just discovered a malware infection on a critical server. According to the standard incident handling phases, which phase should occur immediately after the containment phase?
Select an answer first
10foundation · easy
A security analyst notices multiple failed login attempts followed by a successful login from an unusual geographic location. Which technique is being used to detect this potential incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Incident Handling & Response GSEC Practice Questions (Page 2)

Questions 6–10

A security analyst discovers that an employee's workstation has been compromised and may contain evidence of data exfiltration. The company plans to pursue legal action against the employee. Which action is MOST important to ensure the evidence is admissible in court?

A company has just finished eradicating a ransomware infection from all affected servers and restored data from backups. The incident response team is now meeting to discuss what went well and what could be improved. According to the incident handling phases, which activity should occur next?

An organization has just discovered a malware infection on a critical server. According to the standard incident handling phases, which phase should occur immediately after the containment phase?

A security analyst notices multiple failed login attempts followed by a successful login from an unusual geographic location. Which technique is being used to detect this potential incident?

Keep studying — Security Operations and Incident Response