During triage, an incident affecting a public-facing web server that handles customer payments is classified as high severity. Which factor most directly contributed to this classification?

The server is not critical to the organization

High impact on business operations

Incident occurred during off-hours

During a malware outbreak, the incident response team identifies that the malware spreads via SMB shares and has infected 15 of 200 workstations. The team needs to contain the spread while preserving evidence for forensic analysis. Which containment strategy should be implemented FIRST?

Run antivirus scans on all 200 workstations

Block SMB traffic at the firewall

Disconnect the infected workstations from the network

Power off the infected workstations immediately

After a ransomware attack, the incident response team has contained the spread and collected forensic images. The company's backups are intact, but the team is unsure if the backups were taken before the initial compromise. The CISO wants to restore operations quickly but also wants to avoid reinfection. Which approach is the BEST for eradication and recovery?

Restore from the most recent backups and hope they are clean

Rebuild the affected systems from known-good media and then restore data from backups that predate the compromise

Restore the systems from backups and then change all passwords

Run a full antivirus scan on the backups before restoring

Which activity is part of the recovery phase of incident handling?

Conducting a post-incident review

Restoring data from clean backups

Isolating the affected network segment

Deleting malware from infected systems

A company discovers that an attacker has been using a compromised VPN account to access the internal network. The attacker has established persistence by creating a new local admin account on several servers. The company wants to contain the incident while preserving evidence for a potential lawsuit. Which containment strategy is MOST appropriate?

Change the passwords of all local admin accounts

Disable the compromised VPN account and revoke the attacker's access

Delete the local admin accounts immediately

Take all affected servers offline

GIAC Security Essentials

Domain 5Objective 1

Incident Handling & Response GSEC Practice Questions (Page 5)

Part of the Security Operations and Incident Response domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 21–25

21foundation · easy
During triage, an incident affecting a public-facing web server that handles customer payments is classified as high severity. Which factor most directly contributed to this classification?
Select an answer first
22application · medium
During a malware outbreak, the incident response team identifies that the malware spreads via SMB shares and has infected 15 of 200 workstations. The team needs to contain the spread while preserving evidence for forensic analysis. Which containment strategy should be implemented FIRST?
Select an answer first
23expert · hard
After a ransomware attack, the incident response team has contained the spread and collected forensic images. The company's backups are intact, but the team is unsure if the backups were taken before the initial compromise. The CISO wants to restore operations quickly but also wants to avoid reinfection. Which approach is the BEST for eradication and recovery?
Select an answer first
24foundation · easy
Which activity is part of the recovery phase of incident handling?
Select an answer first
25expert · hard
A company discovers that an attacker has been using a compromised VPN account to access the internal network. The attacker has established persistence by creating a new local admin account on several servers. The company wants to contain the incident while preserving evidence for a potential lawsuit. Which containment strategy is MOST appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Incident Handling & Response GSEC Practice Questions (Page 5)

Questions 21–25

During triage, an incident affecting a public-facing web server that handles customer payments is classified as high severity. Which factor most directly contributed to this classification?

During a malware outbreak, the incident response team identifies that the malware spreads via SMB shares and has infected 15 of 200 workstations. The team needs to contain the spread while preserving evidence for forensic analysis. Which containment strategy should be implemented FIRST?

Which activity is part of the recovery phase of incident handling?

Keep studying — Security Operations and Incident Response