A user reports that their computer is infected after visiting a compromised website. The website delivered an exploit kit that exploited a browser vulnerability. Which control would have been MOST effective in preventing this infection?

Disabling JavaScript in the browser

Keeping the browser and plugins up to date

An organization is experiencing repeated infections from malware delivered via malicious email attachments. The security team has implemented email filtering and user awareness training, but infections continue. Which additional control would be most effective in reducing the impact of these infections?

Enable application whitelisting to block unauthorized executables

Increase the frequency of antivirus signature updates

Deploy host-based intrusion prevention on all endpoints

A company discovers that a worm has infected several servers. The worm is spreading rapidly, and the incident response team needs to contain it while preserving evidence for a potential legal case. Which action should be taken first?

Isolate the infected servers from the network

Notify law enforcement before taking any action

Perform a full forensic image of each server

Run antivirus scans on all servers

During a malware incident, the response team must preserve evidence while minimizing disruption to business operations. The infected server hosts a critical application that cannot be taken offline for long. Which approach best balances evidence preservation and business continuity?

Take the server offline immediately and perform a full forensic image

Perform a live memory capture and a logical file copy, then isolate the server from the network

Delete the malware and continue operations without further analysis

Rebuild the server from backups without preserving evidence

A security analyst receives a suspicious executable from a user. The analyst wants to determine if the binary contains any embedded strings that might reveal command-and-control URLs or encryption keys. Which analysis technique should be used FIRST?

Submit the file to an online multi-scanner

Run the executable on a sacrificial machine

Static analysis using a strings utility

GIAC Security Essentials

Domain 5Objective 3

Malicious Code & Exploit Mitigation GSEC Practice Questions (Page 7)

Part of the Security Operations and Incident Response domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 31–35

31application · medium
A user reports that their computer is infected after visiting a compromised website. The website delivered an exploit kit that exploited a browser vulnerability. Which control would have been MOST effective in preventing this infection?
Select an answer first
32expert · hard
An organization is experiencing repeated infections from malware delivered via malicious email attachments. The security team has implemented email filtering and user awareness training, but infections continue. Which additional control would be most effective in reducing the impact of these infections?
Select an answer first
33expert · hard
A company discovers that a worm has infected several servers. The worm is spreading rapidly, and the incident response team needs to contain it while preserving evidence for a potential legal case. Which action should be taken first?
Select an answer first
34expert · hard
During a malware incident, the response team must preserve evidence while minimizing disruption to business operations. The infected server hosts a critical application that cannot be taken offline for long. Which approach best balances evidence preservation and business continuity?
Select an answer first
35application · easy
A security analyst receives a suspicious executable from a user. The analyst wants to determine if the binary contains any embedded strings that might reveal command-and-control URLs or encryption keys. Which analysis technique should be used FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.