GSEC Incident Handling and Response — All Questions With Answers

Question 1

An organization detects unauthorized lateral movement across a segmented network. Which incident handling phase is primarily responsible for identifying the scope of the compromise and determining if data exfiltration occurred?

Accepted Answer

Identification. The Identification phase focuses on confirming the existence of an incident and defining its scope. By analyzing logs, flows, and endpoint artifacts, responders determine the breadth of the adversary's reach. This is critical because accurate scoping prevents incomplete remediation, ensuring that attackers cannot easily regain access using missed backdoors or persistent credentials discovered during the investigation.

Answer

Preparation

Answer

Containment

Answer

Lessons Learned

Question 2

Which TWO of the following are primary goals of the Post-Incident Activity phase of the incident response lifecycle?

Accepted Answer

Identifying the initial entry point of the attacker. Post-incident activities, often called 'Lessons Learned', focus on improving future responses and ensuring total remediation. It is critical for an organization to perform a root cause analysis to prevent recurrence and to update its security posture based on the evidence collected. Without this phase, organizations repeat the same mistakes, failing to mature their defense mechanisms against recurring threat patterns.

Answer

Establishing a standard incident response team hierarchy

Answer

Validating the integrity of restored systems

Answer

Isolating infected systems from the production network

Question 3

An incident responder is investigating a potential data breach involving sensitive PII. Which order of volatility should the responder follow when collecting evidence?

Accepted Answer

Registers, cache, memory, hard drives. The order of volatility dictates that data should be collected from the most ephemeral to the most permanent. Memory (RAM) contains the most transient evidence, such as running processes and encryption keys. If this is not captured first, it is lost during a reboot. Proper sequencing ensures that critical, time-sensitive evidence is preserved before it is overwritten or lost by system processes.

Answer

Hard drives, memory, cache, registers

Answer

Memory, hard drives, cache, registers

Answer

Hard drives, registers, cache, memory

Question 4

A security analyst at a financial services firm receives an alert from the SIEM indicating that a workstation has initiated a large outbound data transfer to an unfamiliar IP address in a foreign country. The analyst confirms the workstation belongs to an employee in the accounting department who is currently on vacation. According to the GIAC incident handling process, which action should the analyst take FIRST?

Accepted Answer

Immediately isolate the workstation from the network to prevent further data exfiltration.. The correct answer is to immediately isolate the workstation. In incident handling, containment is the phase where you limit the scope and impact of an incident. Since the analyst has confirmed the anomaly and the employee's absence, there is a strong indication of unauthorized activity. Isolating the workstation stops further data exfiltration and preserves the ability to investigate. Other actions like contacting the employee or capturing forensic images are important but secondary to stopping the active data loss.

Answer

Review the SIEM logs to determine the exact files that were transferred.

Answer

Contact the employee to verify whether the data transfer was authorized.

Answer

Capture a forensic image of the workstation's memory and disk before taking any other action.

Question 5

A security incident responder is investigating a compromised Linux server. The responder needs to collect volatile data before shutting down the system. Which of the following commands should the responder use to capture the current network connections and listening ports?

Accepted Answer

netstat -anp. The correct command is netstat -anp. It provides a comprehensive view of all network connections and listening ports, including the process IDs associated with each. This is essential for identifying malicious network activity and the responsible processes. Other commands like ps aux, ifconfig -a, and lsof -i serve different purposes and do not capture the required network connection data in a single, standard output. Collecting this volatile data before shutdown is critical for incident analysis.

Answer

lsof -i

Answer

ps aux

Answer

ifconfig -a

Question 6

Refer to the exhibit. An analyst observes this command execution on a workstation. Which immediate action represents the most effective containment strategy?

Accepted Answer

Isolate the workstation from the network. The exhibit shows base64 encoded PowerShell execution, commonly used for malicious script downloads. Immediate containment requires isolating the endpoint from the network to prevent further outbound connections to C2 servers. By severing the network connection, responders prevent the attacker from executing additional instructions, exfiltrating data, or establishing secondary persistence mechanisms while the forensic investigation proceeds offline.

Answer

Reboot the workstation immediately

Answer

Delete the PowerShell process

Answer

Update the antivirus definitions

Question 7

An organization is deploying an automated incident response tool. Which requirement is most important to ensure the tool's effectiveness during a high-severity security incident?

Accepted Answer

Pre-defined and validated response playbooks. Automated tools must have clear, pre-defined playbooks. If automation is used without strict, validated logic, it may trigger unintended consequences, such as locking out critical production services or deleting valid data during an active attack. Effective automation requires accurate context to prevent the incident response tool from causing more operational downtime than the actual security threat it is designed to mitigate during a crisis.

Answer

Integration with the social media monitoring platform

Answer

Integration with external threat intelligence feeds

Answer

Unlimited cloud storage for log retention

Question 8

During an investigation, you discover a persistent backdoor. Which THREE actions should be included in the Eradication phase?

Accepted Answer

Resetting compromised user passwords. Eradication aims to completely remove the adversary's presence. Simply deleting a file is rarely sufficient; attackers often leave multiple persistence mechanisms or backdoors. By resetting credentials, patching the underlying vulnerability, and re-imaging systems, the organization ensures that the attacker cannot easily return, effectively closing the window of opportunity that allowed the initial unauthorized access to occur and persist.

Answer

Analyzing the memory dump for malware signatures

Answer

Drafting an incident report for executive leadership

Question 9

Refer to the exhibit. Which type of attack is being mitigated by the application framework, and what incident phase should this alert trigger?

Accepted Answer

Cross-Site Scripting; Identification. The exhibit shows a Cross-Site Scripting (XSS) attempt blocked by the application's input validation layer. This should trigger the Identification phase of the incident response lifecycle. Even though the attack was blocked, it indicates an attacker is actively probing the application for vulnerabilities. Early detection allows the team to block the source IP and verify if other, more successful, attempts were made against the infrastructure.

Answer

SQL Injection; Containment

Answer

Cross-Site Request Forgery; Eradication

Answer

Buffer Overflow; Preparation

Question 10

Which document is essential to have in place before an incident occurs to ensure legal and regulatory compliance regarding data privacy and breach notification?

Accepted Answer

The Incident Response Plan. An Incident Response Plan (IRP) defines the procedures, roles, and communication paths required during a breach. It is essential for compliance because it dictates the timeline and requirements for notifying regulators and affected parties. Without a pre-established plan, organizations often fail to meet legal reporting deadlines, resulting in significant fines and loss of stakeholder trust, making the IRP a foundational piece of the response process.

Answer

A list of all employee hardware serial numbers

Answer

The corporate employee handbook

Answer

The server room floor plan

Question 11

An analyst receives an alert that a server's CPU usage has spiked to 100% and is generating outbound traffic to a known command-and-control IP address. The server is critical for a production application. After confirming the compromise, the analyst decides to isolate the server from the network. Which incident response phase does this action fall under?

Accepted Answer

Containment. The correct answer is containment because isolating a compromised server is a direct step to limit the incident's spread and impact. Containment actions are taken immediately after detection to prevent further damage, while eradication and recovery come later. Preparation is pre-incident, and recovery restores normal operations.

Answer

Preparation

Answer

Recovery

Answer

Eradication

Question 12

After a major security breach, the incident response team conducts a lessons-learned meeting. The team identifies that the initial detection was delayed because log sources were not properly integrated into the SIEM. Which phase of the incident response lifecycle does this finding primarily aim to improve?

Accepted Answer

Preparation. The finding that log sources were not integrated into the SIEM points to a gap in preparation. Preparation involves setting up logging, monitoring, and detection tools. By addressing this, the team enhances future detection capabilities. While the review occurs in Post-Incident Activity, the corrective action targets Preparation.

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 13

A security analyst receives an alert that a workstation's antivirus detected and quarantined a known trojan. The endpoint is still running and the user reports no unusual behavior. According to the SANS six-step incident handling process, which phase is the analyst currently in?

Accepted Answer

Identification. The SANS incident handling process begins with Preparation, followed by Identification, Containment, Eradication, Recovery, and Lessons Learned. When an alert fires and an analyst validates that a genuine security event has occurred, the activity maps to Identification. No containment, eradication, or recovery actions have been described, so the scenario sits squarely in the Identification phase.

Answer

Eradication

Answer

Containment

Answer

Recovery

Question 14

A responder is preparing to image a compromised Windows server's memory before shutting it down. The server hosts a critical database and management insists on minimal downtime. Which action best preserves the most volatile evidence while respecting the operational constraint?

Accepted Answer

Capture a full physical memory dump using a trusted tool, then proceed with containment and shutdown.. The order of volatility dictates that the most perishable evidence, such as RAM contents, be collected first. A physical memory dump captures running processes, network connections, and in-memory-only malware before containment actions alter or destroy them. Once memory is secured, the responder can contain and shut down the server, satisfying both forensic integrity and the operational requirement to minimize downtime.

Answer

Disconnect the server from the network, then capture memory after confirming no active sessions remain.

Answer

Shut down the server immediately to prevent lateral movement, then image the disk on a write blocker.

Answer

Run a full antivirus scan and collect the resulting log before capturing memory.

Question 15

During an investigation, an analyst finds that a compromised host has an outbound connection to a known command-and-control IP every 60 seconds. The host is on a production VLAN with other servers. Which containment strategy best limits the adversary's access while preserving evidence for later analysis?

Accepted Answer

Isolate the host using network access control or an EDR network containment feature, keeping it powered on for memory capture.. Effective containment must both stop the adversary's access and preserve evidence for later analysis. Isolating the host through NAC or EDR network containment severs the C2 channel and prevents lateral movement across the production VLAN while leaving the system powered on, so volatile memory and active connections can still be captured. This balances operational risk with forensic integrity.

Answer

Immediately power off the host to sever the C2 channel and prevent further data exfiltration.

Answer

Change the host's IP address and update DNS records to redirect the adversary to a honeypot.

Answer

Block the C2 IP at the perimeter firewall and leave the host online to observe further adversary behavior.

Question 16

A company's incident response plan requires a formal lessons-learned review after a major ransomware incident. Which TWO activities are appropriate during the Post-Incident Activity phase? (Choose two.)

Accepted Answer

Conduct a meeting with stakeholders to review what worked, what failed, and how to improve the plan.. The Post-Incident Activity phase is about learning from the incident and improving future response. Holding a stakeholder review meeting and updating the IR plan and detection rules based on findings both directly serve that purpose. Recovery and eradication actions belong to earlier phases, and containment is likewise an earlier-phase activity, so they are not appropriate here.

Answer

Reimage all affected endpoints and restore data from the most recent backups.

Answer

Isolate the compromised network segment to prevent the ransomware from spreading further.

Answer

Eradicate the ransomware binaries and remove persistence mechanisms from infected hosts.

Question 17

An analyst is examining a Linux server suspected of compromise. The analyst runs a script that lists open network connections, running processes, and loaded kernel modules, but does not copy the binaries to external media. Which principle is the analyst applying?

Accepted Answer

Order of volatility, by collecting live system state before it changes.. The order of volatility directs responders to collect the most perishable evidence first, such as network connections, running processes, and kernel modules, before they change or disappear. By gathering this live state before copying static binaries, the analyst is prioritizing volatile data. Chain of custody, least privilege, and defense in depth address different concerns and do not describe this collection sequence.

Answer

Chain of custody, by documenting each piece of evidence collected.

Answer

Least privilege, by limiting the analyst's access to system resources.

Answer

Defense in depth, by using multiple tools to examine the system.

Question 18

A security team is conducting a post-incident review after a successful ransomware attack. The team identifies that the initial infection vector was a phishing email that delivered a malicious macro. The team wants to improve future response. Which of the following actions is MOST effective for preventing a similar incident from succeeding in the future?

Accepted Answer

Disable macros in Microsoft Office applications by default and only allow signed macros from trusted publishers.. The most effective action is to disable macros by default and allow only signed macros from trusted publishers. This directly prevents the malicious macro from executing, regardless of whether the phishing email reaches the user. It is a technical control that enforces a secure configuration and reduces the attack surface. While other measures like training, EDR, and email filtering add defense in depth, they are not as reliable in stopping this specific vector. Disabling macros is a best practice recommended by security organizations.

Answer

Implement a security awareness training program that teaches employees to recognize phishing emails.

Answer

Deploy an endpoint detection and response (EDR) solution to detect and block malicious macro execution.

Answer

Configure email filtering to block all emails with macro-enabled attachments.

Question 19

A security analyst is responding to a confirmed malware infection on a critical server. The analyst has already contained the infection by isolating the server from the network. According to the incident handling process, which TWO actions should the analyst perform during the eradication phase? (Choose two.)

Accepted Answer

Apply security patches and updates to the server's operating system and applications.. The correct actions are to identify and remove all malicious files and processes, and to apply security patches and updates. Eradication is the phase where the threat is eliminated from the environment. This includes removing malware and addressing the vulnerability that allowed the infection. Patching ensures that the same attack vector cannot be used again. Restoring from backup, post-incident review, and monitoring are associated with recovery or post-incident activities, not eradication.

Answer

Conduct a post-incident review to document lessons learned.

Answer

Restore the server from a known good backup taken before the infection.

Answer

Monitor network traffic for signs of re-infection.

Question 20

A junior analyst at a healthcare provider receives a call from the help desk: a radiology workstation is behaving erratically and displaying a ransom note. The analyst immediately opens a remote session, logs in with domain administrator credentials, and begins deleting suspicious files in the user's startup folder. The workstation is still powered on and connected to the network. Which incident handling principle did the analyst MOST directly violate?

Accepted Answer

Containment must precede eradication to prevent the threat from spreading to other systems.. The analyst began eradication (deleting files) while the compromised workstation remained powered on and connected to the network. This violates the containment-first principle: without isolating the system, malware can spread laterally, communicate with command-and-control, or re-infect. Proper incident handling isolates the host—via network disconnection or VLAN isolation—before removing malicious artifacts. Containment limits damage and preserves evidence for later analysis.

Answer

The analyst used domain administrator credentials, which violates the principle of least privilege.

Answer

The analyst failed to preserve the chain of custody for the workstation's hard drive.

Answer

The analyst should have escalated to senior management before taking any action on the workstation.

GSEC Incident Handling and Response — All Questions With Answers

An organization detects unauthorized lateral movement across a segmented network. Which incident handling phase is primarily responsible for identifying the scope of the compromise and determining if data exfiltration occurred?

Which TWO of the following are primary goals of the Post-Incident Activity phase of the incident response lifecycle?

An incident responder is investigating a potential data breach involving sensitive PII. Which order of volatility should the responder follow when collecting evidence?

A security incident responder is investigating a compromised Linux server. The responder needs to collect volatile data before shutting down the system. Which of the following commands should the responder use to capture the current network connections and listening ports?

Refer to the exhibit. An analyst observes this command execution on a workstation. Which immediate action represents the most effective containment strategy?

Exhibit

An organization is deploying an automated incident response tool. Which requirement is most important to ensure the tool's effectiveness during a high-severity security incident?

During an investigation, you discover a persistent backdoor. Which THREE actions should be included in the Eradication phase?

Refer to the exhibit. Which type of attack is being mitigated by the application framework, and what incident phase should this alert trigger?

Exhibit

Which document is essential to have in place before an incident occurs to ensure legal and regulatory compliance regarding data privacy and breach notification?

A security analyst receives an alert that a workstation's antivirus detected and quarantined a known trojan. The endpoint is still running and the user reports no unusual behavior. According to the SANS six-step incident handling process, which phase is the analyst currently in?

A responder is preparing to image a compromised Windows server's memory before shutting it down. The server hosts a critical database and management insists on minimal downtime. Which action best preserves the most volatile evidence while respecting the operational constraint?

A company's incident response plan requires a formal lessons-learned review after a major ransomware incident. Which TWO activities are appropriate during the Post-Incident Activity phase? (Choose two.)

An analyst is examining a Linux server suspected of compromise. The analyst runs a script that lists open network connections, running processes, and loaded kernel modules, but does not copy the binaries to external media. Which principle is the analyst applying?

GSEC Incident Handling and Response — All Questions With Answers

An organization detects unauthorized lateral movement across a segmented network. Which incident handling phase is primarily responsible for identifying the scope of the compromise and determining if data exfiltration occurred?

Which TWO of the following are primary goals of the Post-Incident Activity phase of the incident response lifecycle?

An incident responder is investigating a potential data breach involving sensitive PII. Which order of volatility should the responder follow when collecting evidence?

A security incident responder is investigating a compromised Linux server. The responder needs to collect volatile data before shutting down the system. Which of the following commands should the responder use to capture the current network connections and listening ports?

Refer to the exhibit. An analyst observes this command execution on a workstation. Which immediate action represents the most effective containment strategy?

Exhibit

An organization is deploying an automated incident response tool. Which requirement is most important to ensure the tool's effectiveness during a high-severity security incident?

During an investigation, you discover a persistent backdoor. Which THREE actions should be included in the Eradication phase?

Refer to the exhibit. Which type of attack is being mitigated by the application framework, and what incident phase should this alert trigger?

Exhibit

Which document is essential to have in place before an incident occurs to ensure legal and regulatory compliance regarding data privacy and breach notification?

A security analyst receives an alert that a workstation's antivirus detected and quarantined a known trojan. The endpoint is still running and the user reports no unusual behavior. According to the SANS six-step incident handling process, which phase is the analyst currently in?

A responder is preparing to image a compromised Windows server's memory before shutting it down. The server hosts a critical database and management insists on minimal downtime. Which action best preserves the most volatile evidence while respecting the operational constraint?

A company's incident response plan requires a formal lessons-learned review after a major ransomware incident. Which TWO activities are appropriate during the Post-Incident Activity phase? (Choose two.)

An analyst is examining a Linux server suspected of compromise. The analyst runs a script that lists open network connections, running processes, and loaded kernel modules, but does not copy the binaries to external media. Which principle is the analyst applying?