A SOC analyst is reviewing an EDR alert that shows a PowerShell script executed on a workstation and then deleted itself. The script downloaded a second-stage payload from a URL that is now offline. Which EDR capability would be most useful to reconstruct what the script did?

Process command-line and script block logging.

File integrity monitoring on the system directory.

Memory dump of the workstation.

Network flow logs from the firewall.

An organization wants to reduce the risk of USB-based malware infections on employee workstations. Employees frequently need to use USB drives to transfer files between air-gapped systems. Which control is most effective while still allowing the required USB use?

Disable all USB ports via Group Policy.

Instruct users to scan USB drives with antivirus before use.

Enable USB device control to allow only approved USB drives by serial number.

Set USB drives to read-only using registry settings.

An organization is evaluating endpoint protection solutions. They need to block known malware, detect fileless attacks, and provide forensic data for incident response. They have a limited budget and cannot afford multiple products. Which single solution type best meets all three requirements?

Host intrusion prevention system (HIPS) only

Next-generation antivirus (NGAV) with behavioral detection and EDR capabilities

Traditional signature-based antivirus

A security administrator wants to prevent users from installing unauthorized software on their company-issued Windows workstations. Which control is the most effective for this requirement?

Host firewall that blocks inbound connections

Application whitelisting that only allows approved executables to run

User awareness training on safe software practices

Antivirus software with real-time scanning

What is the first step in responding to a confirmed endpoint security incident?

Notify law enforcement immediately

Contain the incident to prevent further damage

Eradicate the threat from the endpoint

Identify the scope and impact of the incident

GIAC Security Operations Certified

Domain 1Objective 2

Endpoint Defense GSOC Practice Questions (Page 1)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

Questions 1–5

1application · medium
A SOC analyst is reviewing an EDR alert that shows a PowerShell script executed on a workstation and then deleted itself. The script downloaded a second-stage payload from a URL that is now offline. Which EDR capability would be most useful to reconstruct what the script did?
Select an answer first
2application · medium
An organization wants to reduce the risk of USB-based malware infections on employee workstations. Employees frequently need to use USB drives to transfer files between air-gapped systems. Which control is most effective while still allowing the required USB use?
Select an answer first
3expert · hard
An organization is evaluating endpoint protection solutions. They need to block known malware, detect fileless attacks, and provide forensic data for incident response. They have a limited budget and cannot afford multiple products. Which single solution type best meets all three requirements?
Select an answer first
4application · medium
A security administrator wants to prevent users from installing unauthorized software on their company-issued Windows workstations. Which control is the most effective for this requirement?
Select an answer first
5foundation · easy
What is the first step in responding to a confirmed endpoint security incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.