A company discovers that a worm has propagated across multiple departments, infecting hundreds of workstations. The incident response team has isolated infected systems from the network. What is the next step in the incident response process?

Eradication – remove the malware from all systems

Lessons learned – document the incident

Recovery – restore systems from backups

Detection – identify all infected systems

A user reports that their system is infected with ransomware after visiting a compromised website. The website exploited a browser vulnerability to deliver the ransomware. Which infection vector and mitigation technique are most relevant?

Malicious website; browser sandboxing

Removable media; application whitelisting

Which endpoint protection mechanism monitors system calls and network activity in real time to block suspicious behavior that may indicate malware?

Host-based intrusion prevention system (HIPS)

A small law firm reports that several workstations are displaying ransomware messages. The IT admin finds that the infection started after an employee opened a PDF from an unknown sender. The PDF contained an embedded script that downloaded and executed the ransomware. Which combination of controls would BEST reduce the risk of this specific infection vector recurring?

Enable ASLR and DEP on all workstations and disable USB ports

Train users to recognize phishing emails and require them to report suspicious messages to IT

Deploy a network-based intrusion prevention system and increase the frequency of full disk backups

Block email attachments with macros or scripts at the gateway and enable application whitelisting on endpoints

An analyst discovers a file that copies itself to network shares and also drops a payload that encrypts user documents. The file does not require user interaction to spread. How should this malware be classified?

Ransomware with worm propagation

GIAC Security Essentials

Domain 5Objective 3

Malicious Code & Exploit Mitigation GSEC Practice Questions (Page 3)

Part of the Security Operations and Incident Response domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 11–15

11application · medium
A company discovers that a worm has propagated across multiple departments, infecting hundreds of workstations. The incident response team has isolated infected systems from the network. What is the next step in the incident response process?
Select an answer first
12application · medium
A user reports that their system is infected with ransomware after visiting a compromised website. The website exploited a browser vulnerability to deliver the ransomware. Which infection vector and mitigation technique are most relevant?
Select an answer first
13foundation · easy
Which endpoint protection mechanism monitors system calls and network activity in real time to block suspicious behavior that may indicate malware?
Select an answer first
14application · medium
A small law firm reports that several workstations are displaying ransomware messages. The IT admin finds that the infection started after an employee opened a PDF from an unknown sender. The PDF contained an embedded script that downloaded and executed the ransomware. Which combination of controls would BEST reduce the risk of this specific infection vector recurring?
Select an answer first
15application · medium
An analyst discovers a file that copies itself to network shares and also drops a payload that encrypts user documents. The file does not require user interaction to spread. How should this malware be classified?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.