A security analyst notices that a single workstation has been making repeated outbound connections to a known malicious IP address over the past hour. The EDR console shows that the process making the connections is a signed, legitimate system binary that is executing from an unusual path. The analyst needs to contain the threat while preserving forensic evidence. Which action should the analyst take first?

Isolate the workstation from the network using the EDR console.

Delete the suspicious binary from the file system.

Disable the user's Active Directory account.

Reboot the workstation to clear the malicious process from memory.

A user reports that their laptop is running slowly and the hard drive is constantly active. The security team finds a process named 'svchost.exe' running from the user's AppData folder. The process is making outbound connections to a foreign IP address. Which type of endpoint threat is most likely present?

Worm spreading through the network.

Trojan horse disguised as a legitimate system process.

A security analyst sees an EDR alert for a process that is injecting code into another process. The analyst wants to confirm whether this is malicious or a legitimate application behavior. Which EDR data would be most useful?

The file hash of the injecting process

The network connections of the target process

The process tree and command-line arguments of both processes

A company is deploying new laptops to remote workers. The security team wants to ensure that the laptops are protected before they connect to the corporate network. Which combination of controls should be implemented?

Full-disk encryption, host firewall, and EDR agent.

VPN client and two-factor authentication for VPN access.

Screen lock timeout and password complexity policy.

Application whitelisting and removable media control.

An EDR alert fires on a workstation for a suspicious PowerShell command. The analyst wants to see what happened before and after the command to understand the full attack sequence. Which EDR feature is designed for this?

Root cause analysis that maps the attack chain

Vulnerability scanning of the endpoint

GIAC Security Operations Certified

Domain 1Objective 2

Endpoint Defense GSOC Practice Questions (Page 3)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

Questions 11–15

11application · medium
A security analyst notices that a single workstation has been making repeated outbound connections to a known malicious IP address over the past hour. The EDR console shows that the process making the connections is a signed, legitimate system binary that is executing from an unusual path. The analyst needs to contain the threat while preserving forensic evidence. Which action should the analyst take first?
Select an answer first
12application · medium
A user reports that their laptop is running slowly and the hard drive is constantly active. The security team finds a process named 'svchost.exe' running from the user's AppData folder. The process is making outbound connections to a foreign IP address. Which type of endpoint threat is most likely present?
Select an answer first
13application · medium
A security analyst sees an EDR alert for a process that is injecting code into another process. The analyst wants to confirm whether this is malicious or a legitimate application behavior. Which EDR data would be most useful?
Select an answer first
14application · medium
A company is deploying new laptops to remote workers. The security team wants to ensure that the laptops are protected before they connect to the corporate network. Which combination of controls should be implemented?
Select an answer first
15application · medium
An EDR alert fires on a workstation for a suspicious PowerShell command. The analyst wants to see what happened before and after the command to understand the full attack sequence. Which EDR feature is designed for this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

Endpoint Defense GSOC Practice Questions (Page 3)

Questions 11–15

A security analyst sees an EDR alert for a process that is injecting code into another process. The analyst wants to confirm whether this is malicious or a legitimate application behavior. Which EDR data would be most useful?

A company is deploying new laptops to remote workers. The security team wants to ensure that the laptops are protected before they connect to the corporate network. Which combination of controls should be implemented?

An EDR alert fires on a workstation for a suspicious PowerShell command. The analyst wants to see what happened before and after the command to understand the full attack sequence. Which EDR feature is designed for this?

Keep studying — Security Operations Fundamentals