A security analyst notices that a user's workstation is sending a large volume of emails to external addresses during off-hours. The emails contain the user's contacts and internal documents. Which type of endpoint threat is most likely responsible?

Ransomware that is encrypting files and demanding payment.

A worm that is spreading via email attachments.

A keylogger that is recording keystrokes.

Information-stealing malware that is exfiltrating data via email.

During an endpoint incident, the incident response team needs to preserve evidence for potential legal action. The team has identified a running malicious process and a file on disk. Which action should be taken to preserve the most useful evidence?

Capture a memory dump and create a forensic image of the disk.

Copy the malicious file to a network share.

Run a full antivirus scan and save the report.

Reboot the system to clear the malicious process.

A security analyst is evaluating endpoint protection for a fleet of servers that run legacy applications. The applications are known to create temporary files in the system directory and occasionally modify registry keys. The team wants to detect malicious behavior without breaking the legacy applications. Which approach should the analyst recommend?

Deploy an EDR solution and create exclusions for the known benign behaviors.

Deploy a traditional antivirus with real-time scanning and no exclusions.

Use application whitelisting to block all executables except the legacy applications.

Enable a host-based firewall and block all outbound traffic.

Which endpoint hardening practice is most effective in reducing the risk of exploitation of known software vulnerabilities?

Using a complex password for the administrator account

Increasing the number of user accounts

Regularly applying security patches and updates

A SOC is investigating a series of suspicious logins from a single workstation. The EDR shows that the workstation has been running a PowerShell script that periodically connects to a remote server. The analyst needs to determine whether the script is benign automation or malicious. Which combination of evidence would be most conclusive?

Compare the script's hash against known malware databases and review the script's content for obfuscation or suspicious commands.

Examine the remote server's SSL certificate.

Review the user's email and browsing history.

Check the workstation's uptime and recent patch history.

GIAC Security Operations Certified

Domain 1Objective 2

Endpoint Defense GSOC Practice Questions (Page 4)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

Questions 16–20

16application · medium
A security analyst notices that a user's workstation is sending a large volume of emails to external addresses during off-hours. The emails contain the user's contacts and internal documents. Which type of endpoint threat is most likely responsible?
Select an answer first
17application · medium
During an endpoint incident, the incident response team needs to preserve evidence for potential legal action. The team has identified a running malicious process and a file on disk. Which action should be taken to preserve the most useful evidence?
Select an answer first
18application · medium
A security analyst is evaluating endpoint protection for a fleet of servers that run legacy applications. The applications are known to create temporary files in the system directory and occasionally modify registry keys. The team wants to detect malicious behavior without breaking the legacy applications. Which approach should the analyst recommend?
Select an answer first
19foundation · easy
Which endpoint hardening practice is most effective in reducing the risk of exploitation of known software vulnerabilities?
Select an answer first
20expert · hard
A SOC is investigating a series of suspicious logins from a single workstation. The EDR shows that the workstation has been running a PowerShell script that periodically connects to a remote server. The analyst needs to determine whether the script is benign automation or malicious. Which combination of evidence would be most conclusive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

Endpoint Defense GSOC Practice Questions (Page 4)

Questions 16–20

A security analyst notices that a user's workstation is sending a large volume of emails to external addresses during off-hours. The emails contain the user's contacts and internal documents. Which type of endpoint threat is most likely responsible?

During an endpoint incident, the incident response team needs to preserve evidence for potential legal action. The team has identified a running malicious process and a file on disk. Which action should be taken to preserve the most useful evidence?

Which endpoint hardening practice is most effective in reducing the risk of exploitation of known software vulnerabilities?

Keep studying — Security Operations Fundamentals