Incident Handling & Response GSEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During a malware outbreak, a security analyst identifies a single workstation that is actively communicating with a known command-and-control (C2) server. The workstation is used by the finance team and contains sensitive spreadsheets. The analyst needs to contain the threat while preserving evidence for potential legal action. Which containment action best balances these needs?

   • AApply a host-based firewall rule to block the C2 server IP address.
   • BDisconnect the network cable and take a memory image before further analysis.
   • CCopy all files from the workstation to a network share and then reimage the system.
   • DPower off the workstation immediately to stop the C2 communication.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has just finished responding to a ransomware incident. The incident response team is writing the final report. Which element is MOST important to include in the report for future prevention?

   • AThe total cost of the incident
   • BA detailed timeline of the incident
   • CThe root cause analysis and recommended security improvements
   • DThe names of the employees who were affected
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has experienced a data breach involving customer personal data. The incident response team is preparing to notify affected customers. The legal counsel advises that the notification must include the nature of the breach and the steps customers should take. The PR department wants to minimize reputational damage. Which communication approach BEST balances legal requirements and PR concerns?

   • AHave the PR department issue a statement without legal review
   • BProvide a detailed technical analysis of the attack vector to customers
   • CDelay notification until the investigation is complete
   • DIssue a clear, concise notification that includes required information and practical steps for customers
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   After resolving a security incident, the incident response team meets to discuss what went well and what could be improved. What is this activity called?

   • AVulnerability assessment
   • BLessons learned review
   • CThreat hunting
   • DRoot cause analysis
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization suspects an insider threat and needs to collect evidence from a laptop without alerting the employee. The legal team requires that the evidence be admissible in court. Which approach best preserves the integrity of the evidence?

   • AUse a write-blocker to create a forensic image of the hard drive.
   • BCopy the user's files to an external USB drive and then analyze the copy.
   • CSeize the laptop and power it down before making any copies.
   • DRun a live analysis tool on the laptop to collect running processes and network connections.
   Reveal Solution Discussion Select an answer first