GSEC Incident Handling and Response — Timed 10 Questions

Question 1

An organization detects unauthorized lateral movement across a segmented network. Which incident handling phase is primarily responsible for identifying the scope of the compromise and determining if data exfiltration occurred?

10 minute time limit — choose an answer to begin.

Accepted Answer

Identification. The Identification phase focuses on confirming the existence of an incident and defining its scope. By analyzing logs, flows, and endpoint artifacts, responders determine the breadth of the adversary's reach. This is critical because accurate scoping prevents incomplete remediation, ensuring that attackers cannot easily regain access using missed backdoors or persistent credentials discovered during the investigation.

Answer

Preparation

Answer

Containment

Answer

Lessons Learned

Question 2

Which TWO of the following are primary goals of the Post-Incident Activity phase of the incident response lifecycle?

Accepted Answer

Identifying the initial entry point of the attacker. Post-incident activities, often called 'Lessons Learned', focus on improving future responses and ensuring total remediation. It is critical for an organization to perform a root cause analysis to prevent recurrence and to update its security posture based on the evidence collected. Without this phase, organizations repeat the same mistakes, failing to mature their defense mechanisms against recurring threat patterns.

Answer

Establishing a standard incident response team hierarchy

Answer

Validating the integrity of restored systems

Answer

Isolating infected systems from the production network

Question 3

An incident responder is investigating a potential data breach involving sensitive PII. Which order of volatility should the responder follow when collecting evidence?

Accepted Answer

Registers, cache, memory, hard drives. The order of volatility dictates that data should be collected from the most ephemeral to the most permanent. Memory (RAM) contains the most transient evidence, such as running processes and encryption keys. If this is not captured first, it is lost during a reboot. Proper sequencing ensures that critical, time-sensitive evidence is preserved before it is overwritten or lost by system processes.

Answer

Hard drives, memory, cache, registers

Answer

Memory, hard drives, cache, registers

Answer

Hard drives, registers, cache, memory

Question 4

A security analyst at a financial services firm receives an alert from the SIEM indicating that a workstation has initiated a large outbound data transfer to an unfamiliar IP address in a foreign country. The analyst confirms the workstation belongs to an employee in the accounting department who is currently on vacation. According to the GIAC incident handling process, which action should the analyst take FIRST?

Accepted Answer

Immediately isolate the workstation from the network to prevent further data exfiltration.. The correct answer is to immediately isolate the workstation. In incident handling, containment is the phase where you limit the scope and impact of an incident. Since the analyst has confirmed the anomaly and the employee's absence, there is a strong indication of unauthorized activity. Isolating the workstation stops further data exfiltration and preserves the ability to investigate. Other actions like contacting the employee or capturing forensic images are important but secondary to stopping the active data loss.

Answer

Review the SIEM logs to determine the exact files that were transferred.

Answer

Contact the employee to verify whether the data transfer was authorized.

Answer

Capture a forensic image of the workstation's memory and disk before taking any other action.

Question 5

A security incident responder is investigating a compromised Linux server. The responder needs to collect volatile data before shutting down the system. Which of the following commands should the responder use to capture the current network connections and listening ports?

Accepted Answer

netstat -anp. The correct command is netstat -anp. It provides a comprehensive view of all network connections and listening ports, including the process IDs associated with each. This is essential for identifying malicious network activity and the responsible processes. Other commands like ps aux, ifconfig -a, and lsof -i serve different purposes and do not capture the required network connection data in a single, standard output. Collecting this volatile data before shutdown is critical for incident analysis.

Answer

lsof -i

Answer

ps aux

Answer

ifconfig -a

Question 6

Refer to the exhibit. An analyst observes this command execution on a workstation. Which immediate action represents the most effective containment strategy?

Accepted Answer

Isolate the workstation from the network. The exhibit shows base64 encoded PowerShell execution, commonly used for malicious script downloads. Immediate containment requires isolating the endpoint from the network to prevent further outbound connections to C2 servers. By severing the network connection, responders prevent the attacker from executing additional instructions, exfiltrating data, or establishing secondary persistence mechanisms while the forensic investigation proceeds offline.

Answer

Reboot the workstation immediately

Answer

Delete the PowerShell process

Answer

Update the antivirus definitions

Question 7

An organization is deploying an automated incident response tool. Which requirement is most important to ensure the tool's effectiveness during a high-severity security incident?

Accepted Answer

Pre-defined and validated response playbooks. Automated tools must have clear, pre-defined playbooks. If automation is used without strict, validated logic, it may trigger unintended consequences, such as locking out critical production services or deleting valid data during an active attack. Effective automation requires accurate context to prevent the incident response tool from causing more operational downtime than the actual security threat it is designed to mitigate during a crisis.

Answer

Integration with the social media monitoring platform

Answer

Integration with external threat intelligence feeds

Answer

Unlimited cloud storage for log retention

Question 8

During an investigation, you discover a persistent backdoor. Which THREE actions should be included in the Eradication phase?

Accepted Answer

Resetting compromised user passwords. Eradication aims to completely remove the adversary's presence. Simply deleting a file is rarely sufficient; attackers often leave multiple persistence mechanisms or backdoors. By resetting credentials, patching the underlying vulnerability, and re-imaging systems, the organization ensures that the attacker cannot easily return, effectively closing the window of opportunity that allowed the initial unauthorized access to occur and persist.

Answer

Analyzing the memory dump for malware signatures

Answer

Drafting an incident report for executive leadership

Question 9

Refer to the exhibit. Which type of attack is being mitigated by the application framework, and what incident phase should this alert trigger?

Accepted Answer

Cross-Site Scripting; Identification. The exhibit shows a Cross-Site Scripting (XSS) attempt blocked by the application's input validation layer. This should trigger the Identification phase of the incident response lifecycle. Even though the attack was blocked, it indicates an attacker is actively probing the application for vulnerabilities. Early detection allows the team to block the source IP and verify if other, more successful, attempts were made against the infrastructure.

Answer

SQL Injection; Containment

Answer

Cross-Site Request Forgery; Eradication

Answer

Buffer Overflow; Preparation

Question 10

Which document is essential to have in place before an incident occurs to ensure legal and regulatory compliance regarding data privacy and breach notification?

Accepted Answer

The Incident Response Plan. An Incident Response Plan (IRP) defines the procedures, roles, and communication paths required during a breach. It is essential for compliance because it dictates the timeline and requirements for notifying regulators and affected parties. Without a pre-established plan, organizations often fail to meet legal reporting deadlines, resulting in significant fines and loss of stakeholder trust, making the IRP a foundational piece of the response process.

Answer

A list of all employee hardware serial numbers

Answer

The corporate employee handbook

Answer

The server room floor plan