GSEC Incident Handling and Response — 15 Questions

Question 1

An organization detects unauthorized lateral movement across a segmented network. Which incident handling phase is primarily responsible for identifying the scope of the compromise and determining if data exfiltration occurred?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identification. The Identification phase focuses on confirming the existence of an incident and defining its scope. By analyzing logs, flows, and endpoint artifacts, responders determine the breadth of the adversary's reach. This is critical because accurate scoping prevents incomplete remediation, ensuring that attackers cannot easily regain access using missed backdoors or persistent credentials discovered during the investigation.

Answer

Preparation

Answer

Containment

Answer

Lessons Learned

Question 2

Which TWO of the following are primary goals of the Post-Incident Activity phase of the incident response lifecycle?

Accepted Answer

Identifying the initial entry point of the attacker. Post-incident activities, often called 'Lessons Learned', focus on improving future responses and ensuring total remediation. It is critical for an organization to perform a root cause analysis to prevent recurrence and to update its security posture based on the evidence collected. Without this phase, organizations repeat the same mistakes, failing to mature their defense mechanisms against recurring threat patterns.

Answer

Establishing a standard incident response team hierarchy

Answer

Validating the integrity of restored systems

Answer

Isolating infected systems from the production network

Question 3

An incident responder is investigating a potential data breach involving sensitive PII. Which order of volatility should the responder follow when collecting evidence?

Accepted Answer

Registers, cache, memory, hard drives. The order of volatility dictates that data should be collected from the most ephemeral to the most permanent. Memory (RAM) contains the most transient evidence, such as running processes and encryption keys. If this is not captured first, it is lost during a reboot. Proper sequencing ensures that critical, time-sensitive evidence is preserved before it is overwritten or lost by system processes.

Answer

Hard drives, memory, cache, registers

Answer

Memory, hard drives, cache, registers

Answer

Hard drives, registers, cache, memory

Question 4

A security analyst at a financial services firm receives an alert from the SIEM indicating that a workstation has initiated a large outbound data transfer to an unfamiliar IP address in a foreign country. The analyst confirms the workstation belongs to an employee in the accounting department who is currently on vacation. According to the GIAC incident handling process, which action should the analyst take FIRST?

Accepted Answer

Immediately isolate the workstation from the network to prevent further data exfiltration.. The correct answer is to immediately isolate the workstation. In incident handling, containment is the phase where you limit the scope and impact of an incident. Since the analyst has confirmed the anomaly and the employee's absence, there is a strong indication of unauthorized activity. Isolating the workstation stops further data exfiltration and preserves the ability to investigate. Other actions like contacting the employee or capturing forensic images are important but secondary to stopping the active data loss.

Answer

Review the SIEM logs to determine the exact files that were transferred.

Answer

Contact the employee to verify whether the data transfer was authorized.

Answer

Capture a forensic image of the workstation's memory and disk before taking any other action.

Question 5

A security incident responder is investigating a compromised Linux server. The responder needs to collect volatile data before shutting down the system. Which of the following commands should the responder use to capture the current network connections and listening ports?

Accepted Answer

netstat -anp. The correct command is netstat -anp. It provides a comprehensive view of all network connections and listening ports, including the process IDs associated with each. This is essential for identifying malicious network activity and the responsible processes. Other commands like ps aux, ifconfig -a, and lsof -i serve different purposes and do not capture the required network connection data in a single, standard output. Collecting this volatile data before shutdown is critical for incident analysis.

Answer

lsof -i

Answer

ps aux

Answer

ifconfig -a

Question 6

Refer to the exhibit. An analyst observes this command execution on a workstation. Which immediate action represents the most effective containment strategy?

Accepted Answer

Isolate the workstation from the network. The exhibit shows base64 encoded PowerShell execution, commonly used for malicious script downloads. Immediate containment requires isolating the endpoint from the network to prevent further outbound connections to C2 servers. By severing the network connection, responders prevent the attacker from executing additional instructions, exfiltrating data, or establishing secondary persistence mechanisms while the forensic investigation proceeds offline.

Answer

Reboot the workstation immediately

Answer

Delete the PowerShell process

Answer

Update the antivirus definitions

Question 7

An organization is deploying an automated incident response tool. Which requirement is most important to ensure the tool's effectiveness during a high-severity security incident?

Accepted Answer

Pre-defined and validated response playbooks. Automated tools must have clear, pre-defined playbooks. If automation is used without strict, validated logic, it may trigger unintended consequences, such as locking out critical production services or deleting valid data during an active attack. Effective automation requires accurate context to prevent the incident response tool from causing more operational downtime than the actual security threat it is designed to mitigate during a crisis.

Answer

Integration with the social media monitoring platform

Answer

Integration with external threat intelligence feeds

Answer

Unlimited cloud storage for log retention

Question 8

During an investigation, you discover a persistent backdoor. Which THREE actions should be included in the Eradication phase?

Accepted Answer

Resetting compromised user passwords. Eradication aims to completely remove the adversary's presence. Simply deleting a file is rarely sufficient; attackers often leave multiple persistence mechanisms or backdoors. By resetting credentials, patching the underlying vulnerability, and re-imaging systems, the organization ensures that the attacker cannot easily return, effectively closing the window of opportunity that allowed the initial unauthorized access to occur and persist.

Answer

Analyzing the memory dump for malware signatures

Answer

Drafting an incident report for executive leadership

Question 9

Refer to the exhibit. Which type of attack is being mitigated by the application framework, and what incident phase should this alert trigger?

Accepted Answer

Cross-Site Scripting; Identification. The exhibit shows a Cross-Site Scripting (XSS) attempt blocked by the application's input validation layer. This should trigger the Identification phase of the incident response lifecycle. Even though the attack was blocked, it indicates an attacker is actively probing the application for vulnerabilities. Early detection allows the team to block the source IP and verify if other, more successful, attempts were made against the infrastructure.

Answer

SQL Injection; Containment

Answer

Cross-Site Request Forgery; Eradication

Answer

Buffer Overflow; Preparation

Question 10

Which document is essential to have in place before an incident occurs to ensure legal and regulatory compliance regarding data privacy and breach notification?

Accepted Answer

The Incident Response Plan. An Incident Response Plan (IRP) defines the procedures, roles, and communication paths required during a breach. It is essential for compliance because it dictates the timeline and requirements for notifying regulators and affected parties. Without a pre-established plan, organizations often fail to meet legal reporting deadlines, resulting in significant fines and loss of stakeholder trust, making the IRP a foundational piece of the response process.

Answer

A list of all employee hardware serial numbers

Answer

The corporate employee handbook

Answer

The server room floor plan

Question 11

An analyst receives an alert that a server's CPU usage has spiked to 100% and is generating outbound traffic to a known command-and-control IP address. The server is critical for a production application. After confirming the compromise, the analyst decides to isolate the server from the network. Which incident response phase does this action fall under?

Accepted Answer

Containment. The correct answer is containment because isolating a compromised server is a direct step to limit the incident's spread and impact. Containment actions are taken immediately after detection to prevent further damage, while eradication and recovery come later. Preparation is pre-incident, and recovery restores normal operations.

Answer

Preparation

Answer

Recovery

Answer

Eradication

Question 12

After a major security breach, the incident response team conducts a lessons-learned meeting. The team identifies that the initial detection was delayed because log sources were not properly integrated into the SIEM. Which phase of the incident response lifecycle does this finding primarily aim to improve?

Accepted Answer

Preparation. The finding that log sources were not integrated into the SIEM points to a gap in preparation. Preparation involves setting up logging, monitoring, and detection tools. By addressing this, the team enhances future detection capabilities. While the review occurs in Post-Incident Activity, the corrective action targets Preparation.

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 13

A security analyst receives an alert that a workstation's antivirus detected and quarantined a known trojan. The endpoint is still running and the user reports no unusual behavior. According to the SANS six-step incident handling process, which phase is the analyst currently in?

Accepted Answer

Identification. The SANS incident handling process begins with Preparation, followed by Identification, Containment, Eradication, Recovery, and Lessons Learned. When an alert fires and an analyst validates that a genuine security event has occurred, the activity maps to Identification. No containment, eradication, or recovery actions have been described, so the scenario sits squarely in the Identification phase.

Answer

Eradication

Answer

Containment

Answer

Recovery

Question 14

A responder is preparing to image a compromised Windows server's memory before shutting it down. The server hosts a critical database and management insists on minimal downtime. Which action best preserves the most volatile evidence while respecting the operational constraint?

Accepted Answer

Capture a full physical memory dump using a trusted tool, then proceed with containment and shutdown.. The order of volatility dictates that the most perishable evidence, such as RAM contents, be collected first. A physical memory dump captures running processes, network connections, and in-memory-only malware before containment actions alter or destroy them. Once memory is secured, the responder can contain and shut down the server, satisfying both forensic integrity and the operational requirement to minimize downtime.

Answer

Disconnect the server from the network, then capture memory after confirming no active sessions remain.

Answer

Shut down the server immediately to prevent lateral movement, then image the disk on a write blocker.

Answer

Run a full antivirus scan and collect the resulting log before capturing memory.

Question 15

During an investigation, an analyst finds that a compromised host has an outbound connection to a known command-and-control IP every 60 seconds. The host is on a production VLAN with other servers. Which containment strategy best limits the adversary's access while preserving evidence for later analysis?

Accepted Answer

Isolate the host using network access control or an EDR network containment feature, keeping it powered on for memory capture.. Effective containment must both stop the adversary's access and preserve evidence for later analysis. Isolating the host through NAC or EDR network containment severs the C2 channel and prevents lateral movement across the production VLAN while leaving the system powered on, so volatile memory and active connections can still be captured. This balances operational risk with forensic integrity.

Answer

Immediately power off the host to sever the C2 channel and prevent further data exfiltration.

Answer

Change the host's IP address and update DNS records to redirect the adversary to a honeypot.

Answer

Block the C2 IP at the perimeter firewall and leave the host online to observe further adversary behavior.