Domain 3: Incident Handling & Response (PICERL, containment, forensics)

GIAC Certified Enterprise Defender · 36 questions

• An analyst is investigating a potential intrusion and needs to determine the timeline of events. Which PICERL phase does this activity fall under?
• During an incident, the security team discovers ransomware actively encrypting files on a file server. The server is critical to business operations. What is the most appropriate immediate containment action?
• A forensic examiner is acquiring a disk image from a compromised workstation. Which tool is most appropriate for creating a forensically sound image while preserving hash integrity?
• An incident responder is analyzing a compromised Linux host and wants to identify all network connections established by a suspicious process. Which command provides this information?
• During incident response, a responder discovers a Windows system where an attacker used Scheduled Tasks for persistence. Which Windows artifact should be examined to recover historical task execution data?
• An incident is declared resolved after eradication and recovery. The PICERL model requires one final phase. What activities occur in this phase?
• A memory forensics analyst runs Volatility against a Windows memory image and uses the netscan plugin. What information does this plugin provide?
• What is the primary purpose of maintaining a chain of custody during a digital forensic investigation?
• An incident responder discovers that an attacker used the Windows 'net use' command to map a remote share before deploying ransomware. Which Windows event ID records this type of network share connection?
• An incident responder follows the PICERL model and is in the Containment phase. The team has isolated an infected workstation but the attacker still has access to a compromised domain admin account. What is the correct next action?
• A forensic examiner needs to analyze the Windows Registry for persistence mechanisms on a compromised system. Which registry key is most commonly used by malware to achieve persistence on user logon?
• During a forensic investigation on a Windows system, an analyst discovers that the attacker ran commands that left no files on disk. Which forensic technique can recover evidence of these commands?
• A security team is performing incident response and wants to understand the full scope of an intrusion. Which concept describes the systematic process of using known compromised systems to identify additional compromised infrastructure?
• An incident response team is deciding whether to perform a 'clean rebuild' versus 'clean in place' remediation for a compromised server. What is the primary advantage of a full rebuild from a known good image?
• An incident responder suspects a Windows system was compromised via a malicious email attachment. Which artifact provides the most direct evidence that an email attachment was opened?
• A SOC team is responding to an incident where an attacker exfiltrated 50GB of data over three weeks. The team's incident response policy requires notifying stakeholders within 24 hours of incident confirmation. When does the 24-hour notification clock typically start?
• A forensic examiner is analyzing a disk image and wants to identify all files that were accessed within a specific time window. Which NTFS metadata field records the last access time?
• During an incident involving a compromised web server, the team discovers a PHP webshell at '/var/www/html/uploads/image.php'. What containment and remediation steps are required?
• During the Identification phase of an incident response, an analyst discovers malware on 5 workstations. The malware uses a common C2 IP address. How should the analyst use this information?
• A Windows forensics investigator wants to determine which USB storage devices have been connected to a system. Which Registry key contains this information?
• An incident response team determines that the root cause of a breach was a phishing email that delivered a malicious document. After remediation, what specific control should be added to the Preparation phase update to prevent recurrence?
• A forensic analyst is examining a Linux system and wants to determine the last commands executed in bash by the root user. Which artifact provides this information?
• During incident response, the team discovers that an attacker used a scheduled task to maintain persistence. After removing the scheduled task, what additional recovery step is necessary to ensure persistence is fully eliminated?
• An incident responder receives a report that a user's workstation is communicating with a known malware C2 IP at regular intervals. Before isolating the workstation, what volatile data should be collected first?
• A threat actor uses 'timestomping' on a compromised Windows system. What forensic impact does this technique have?
• An analyst is examining a suspicious Windows executable and wants to perform static analysis without executing it. Which technique provides information about what external libraries and functions the binary calls?
• During a major incident, multiple security teams are working simultaneously. The incident commander wants to ensure that decisions are documented and actions are coordinated. Which document serves as the central record of all incident actions, decisions, and timestamps?
• During an incident response engagement, a responder performs a triage on a Windows system using only built-in tools to avoid introducing foreign binaries. Which Windows built-in command shows all current network connections with their associated process IDs?
• During the Recovery phase of an incident, the team restores a compromised server from a backup taken 48 hours before the incident was detected. The attacker had been present for 5 days before detection. What critical problem exists with this recovery approach?
• A digital forensics examiner needs to recover deleted files from an NTFS volume. Which forensic concept explains why deleted files may still be recoverable?
• An incident response team is investigating a potential insider threat. An employee is suspected of copying sensitive data to personal cloud storage. Which artifact most directly evidences this activity on a Windows system?
• A CISO asks the IR team to ensure they have documented runbooks for the organization's top five likely incident scenarios. Which PICERL phase does creating these runbooks belong to?
• An analyst is investigating an incident and needs to determine if a suspicious binary is known malware. The binary's SHA-256 hash is available. Which resource provides the fastest initial lookup against known malware databases?
• An incident response team needs to preserve the integrity of evidence collected from a compromised server. Which hashing approach provides the strongest evidence of post-collection data integrity?
• A security team is investigating an attack where the adversary used a 'pass-the-ticket' attack. What Windows Kerberos artifact does this attack use and where is it stored?
• During incident response triage, an analyst discovers a suspicious process with PID 4812 running on a Windows system. The process is listed as 'lsass.exe' but the path is 'C:\Windows\Temp\lsass.exe'. What is the most important immediate action?