A company discovers that an attacker has compromised a domain controller and is using it to authenticate to other systems. The incident response team needs to contain the incident while maintaining business operations. Which containment strategy is most effective in this situation?

Block the attacker's IP addresses at the firewall and monitor for further activity.

Isolate the domain controller while maintaining a read-only copy for authentication services.

Reset the domain controller's password and disable its network access.

Disconnect the domain controller from the network immediately.

An organization is responding to a suspected insider threat. The incident response team has identified a laptop that may contain evidence of unauthorized data access. The laptop is currently in use by the employee, and the company wants to avoid alerting the employee. The legal team requires that evidence be preserved for potential litigation. Which action best preserves evidence while minimizing the risk of alerting the employee?

Remotely capture a forensic image of the laptop's hard drive over the network.

Seize the laptop immediately and take it to the forensic lab.

Use a remote management tool to capture memory and running processes without interrupting the employee's work.

Wait until the employee leaves for the day and then seize the laptop.

A security operations center (SOC) receives an alert about a possible malware infection on a server that hosts a critical customer-facing application. The alert is based on a signature that has a high false-positive rate. The SOC analyst must decide whether to treat this as an incident. Which action is most appropriate?

Ignore the alert because the signature has a high false-positive rate.

Investigate the alert by checking the server's processes, network connections, and recent file changes.

Escalate the alert to the incident response team without further investigation.

Immediately isolate the server to prevent potential spread.

A company discovers that an attacker has been exfiltrating data from a file server for several weeks. The attacker's access is through a compromised service account. The team needs to stop the exfiltration while preserving evidence. Which action should be taken FIRST?

Disable the compromised service account

Review the server logs to identify all exfiltrated files

Change the password of the service account

GIAC Security Essentials

Domain 5Objective 1

Incident Handling & Response GSEC Practice Questions (Page 7)

Part of the Security Operations and Incident Response domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 31–35

31application · medium
A company discovers that an attacker has compromised a domain controller and is using it to authenticate to other systems. The incident response team needs to contain the incident while maintaining business operations. Which containment strategy is most effective in this situation?
Select an answer first
32expert · hard
An organization is responding to a suspected insider threat. The incident response team has identified a laptop that may contain evidence of unauthorized data access. The laptop is currently in use by the employee, and the company wants to avoid alerting the employee. The legal team requires that evidence be preserved for potential litigation. Which action best preserves evidence while minimizing the risk of alerting the employee?
Select an answer first
33application · medium
A security operations center (SOC) receives an alert about a possible malware infection on a server that hosts a critical customer-facing application. The alert is based on a signature that has a high false-positive rate. The SOC analyst must decide whether to treat this as an incident. Which action is most appropriate?
Select an answer first
34foundation · easy
After containing a ransomware incident, the incident response team deletes the malicious files and removes the registry entries that allowed the ransomware to execute. Which phase of incident handling does this activity represent?
Select an answer first
35application · medium
A company discovers that an attacker has been exfiltrating data from a file server for several weeks. The attacker's access is through a compromised service account. The team needs to stop the exfiltration while preserving evidence. Which action should be taken FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Incident Handling & Response GSEC Practice Questions (Page 7)

Questions 31–35

A company discovers that an attacker has compromised a domain controller and is using it to authenticate to other systems. The incident response team needs to contain the incident while maintaining business operations. Which containment strategy is most effective in this situation?

After containing a ransomware incident, the incident response team deletes the malicious files and removes the registry entries that allowed the ransomware to execute. Which phase of incident handling does this activity represent?

A company discovers that an attacker has been exfiltrating data from a file server for several weeks. The attacker's access is through a compromised service account. The team needs to stop the exfiltration while preserving evidence. Which action should be taken FIRST?

Keep studying — Security Operations and Incident Response