A security team is evaluating the risk of a new endpoint threat that uses fileless techniques, such as executing malicious code directly in memory. The team wants to implement controls that can detect this type of threat. Which combination of controls is most effective?

Host firewall with application control.

File integrity monitoring on system directories.

Traditional antivirus with signature updates.

EDR with behavioral monitoring and PowerShell script block logging.

An incident responder is investigating a macOS workstation that may have been compromised. The responder needs to determine if any persistence mechanisms were installed. Which log or data source should be examined first?

LaunchAgents and LaunchDaemons directories.

An EDR alert indicates that a workstation has been beaconing to a known malicious IP address every 5 minutes. The analyst needs to determine if the beaconing is still ongoing and whether other hosts are affected. The workstation is in a remote office with limited bandwidth. Which action should the analyst take FIRST?

Run a packet capture on the workstation's network interface

Isolate the workstation immediately and then investigate

Check the EDR console for recent network connections from the workstation and search for the same destination IP across all endpoints

Ask the user to disconnect the workstation from the network

An EDR alert indicates that a process on a Windows server is injecting code into another process. The alert is triggered by a legitimate application that uses code injection for a plugin architecture. The security team wants to reduce false positives without losing visibility into malicious injection. Which action is most appropriate?

Create an EDR exclusion for the specific legitimate application and injection target.

Increase the severity of the alert to force a manual review every time.

Uninstall the legitimate application to prevent the alert.

Disable the EDR alert for all code injection events.

A company is standardizing its Windows endpoint build. The security team wants to reduce the attack surface by disabling unnecessary features and services. Which approach is most effective?

Disable Windows Defender to improve performance.

Set all services to manual startup.

Apply a security baseline that disables unnecessary services and enables Windows Defender Exploit Guard.

Install all available Windows features to ensure compatibility.

GIAC Security Operations Certified

Domain 1Objective 2

Endpoint Defense GSOC Practice Questions (Page 6)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

Questions 26–30

26expert · hard
A security team is evaluating the risk of a new endpoint threat that uses fileless techniques, such as executing malicious code directly in memory. The team wants to implement controls that can detect this type of threat. Which combination of controls is most effective?
Select an answer first
27application · medium
An incident responder is investigating a macOS workstation that may have been compromised. The responder needs to determine if any persistence mechanisms were installed. Which log or data source should be examined first?
Select an answer first
28expert · hard
An EDR alert indicates that a workstation has been beaconing to a known malicious IP address every 5 minutes. The analyst needs to determine if the beaconing is still ongoing and whether other hosts are affected. The workstation is in a remote office with limited bandwidth. Which action should the analyst take FIRST?
Select an answer first
29application · medium
An EDR alert indicates that a process on a Windows server is injecting code into another process. The alert is triggered by a legitimate application that uses code injection for a plugin architecture. The security team wants to reduce false positives without losing visibility into malicious injection. Which action is most appropriate?
Select an answer first
30application · medium
A company is standardizing its Windows endpoint build. The security team wants to reduce the attack surface by disabling unnecessary features and services. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

Endpoint Defense GSOC Practice Questions (Page 6)

Questions 26–30

A security team is evaluating the risk of a new endpoint threat that uses fileless techniques, such as executing malicious code directly in memory. The team wants to implement controls that can detect this type of threat. Which combination of controls is most effective?

An incident responder is investigating a macOS workstation that may have been compromised. The responder needs to determine if any persistence mechanisms were installed. Which log or data source should be examined first?

A company is standardizing its Windows endpoint build. The security team wants to reduce the attack surface by disabling unnecessary features and services. Which approach is most effective?

Keep studying — Security Operations Fundamentals