GIAC GEIR Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Enterprise Incident Response (GEIR) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GEIR certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GEIR Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Enterprise Incident Response (GEIR) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Enterprise Incident Response exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GEIR Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GEIR Sample Questions:
01. Triage archives from 3,000 hosts are arriving on a central collection server, and counsel expects some findings to be used in litigation. The team must be able to show later which host each archive came from, when it was collected and that it has not changed.
What should be recorded for each archive?
a) A chain-of-custody form for each host, signed by the first analyst who opens the archive and listing the artifacts it holds
b) The archive's file-system timestamps on the collection server, showing when it arrived
c) A hash of the archive, with the hostname, collection time and collector profile that produced it
d) A hash of each file inside the archive, taken after analysts parse the contents
02. Plaso timelines built from triage data on 600 servers each hold several years of events, and analysts working in Timesketch are overwhelmed. The investigation has shown that the intrusion began around 12 March and was contained on 20 March.
How should the team make the timelines tractable?
a) Filter the timelines to 12 to 20 March exactly, so no events outside the confirmed window are reviewed
b) Filter the timelines to the intrusion window plus a margin
c) Filter the timelines to events from the first compromised host, then add other hosts as they are confirmed
d) Delete the events older than the intrusion window from the triage archives, so storage and searches both shrink
03. Workstations send DNS queries to an internal resolver at 10.0.0.53, which forwards them to an upstream resolver at the perimeter. The upstream resolver's log shows several queries for a known malicious domain, all from 10.0.0.53.
Which source identifies the workstation that asked for the domain?
a) Passive DNS records for the domain, which show how it resolved across the internet
b) Perimeter firewall logs, which show outbound DNS traffic and its source address
c) Query logs on the internal resolver at 10.0.0.53, which record the address of each querying client
d) DHCP lease logs for 10.0.0.53, which map that address to the host holding it at the time of each query
04. EDR on a Mac records a process tree in which an unsigned binary at /Users/Shared/.svc/agent launched osascript -e 'display dialog "macOS needs your password to continue" default answer "" with hidden answer' shortly after the user logged in.
What does this evidence most likely indicate?
a) A fake password prompt collecting the user's login credentials for the malware
b) A TCC automation prompt raised as the binary began scripting other apps
c) A legitimate macOS authorization request raised by the security framework
d) A Gatekeeper warning that the developer of the downloaded binary could not be verified
05. Responders at a manufacturer believe an intruder stole credentials and moved between systems, but they do not yet know which of about 2,500 Windows hosts are involved. No endpoint agent is deployed, so each collection is a manual live-response session, and the team can complete about 40 today.
Which hosts should be collected first?
a) A random sample drawn from every site, so that the first results represent the whole estate
b) Domain controllers, identity servers, jump hosts and the servers holding the data the intruder would most want to reach
c) The hosts raising the most SIEM alerts this week, since alert volume shows where the intruder is busiest
d) The servers with the largest disks, since they hold the most data the intruder could have taken
06. Over one weekend a team rebuilt the compromised servers, reset the stolen accounts and blocked the attacker's infrastructure. On Monday the business asks for the incident to be declared closed.
What should happen before the incident is closed?
a) Heightened monitoring for this intrusion's TTPs and indicators
b) Reimaging of the remaining hosts in the affected business unit as a precaution
c) A lessons-learned meeting held at once, with the incident closed as soon as its actions are assigned
d) A return to normal alerting thresholds, since the eradication removed the attacker's known footholds
07. After a business-email-compromise attack on a Microsoft 365 tenant, the CFO's mailbox is found to hold an inbox rule that forwards payment emails to an external address and then deletes them. The team must establish when the rule was created and from which IP address.
Which source records this?
a) The message trace, which records the messages the mailbox sent and received
b) The web proxy logs, which record the CFO's connections to the mail service
c) The unified audit log, which records mailbox rule changes
d) The EDR telemetry from the CFO's laptop, which records the processes run on it
08. Several Linux servers were accessed with an SSH key that no administrator recognizes. The team must check all 2,000 Linux servers for the same persistence and for logins that used it.
Which artifacts should the fleet-wide collection gather from each server?
(Choose three.)
a) The authentication log, such as /var/log/auth.log or /var/log/secure
b) The sshd_config file, including any AuthorizedKeysFile setting
c) Every binary under /usr/bin, hashed against a known-good baseline
d) A full disk image of each server, so deleted key files can be recovered
e) Every user's ~/.ssh/authorized_keys file, including root's
09. During live response on a Mac, the responder suspects the intruder granted an extra local account administrator rights. The responder must list every local account that is a member of the administrators group.
Which command shows this?
a) sudo -l -U helpdesk
b) dscl /Local/Default -read /Users/helpdesk
c) dscl /Local/Default -list /Users
d) dscl /Local/Default -read /Groups/admin GroupMembership
10. Malware on a Mac is suspected of capturing the screen and reading files across the whole disk. The responder has a full image and must show which applications had been granted Full Disk Access and screen recording permission.
Which artifact records these grants?
a) The Gatekeeper policy database under /private/var/db/SystemPolicy, which holds app assessment rules
b) The TCC.db under ~/Library/Application Support/com.apple.TCC/, which lists each client app and the service it was granted
c) The TCC.db under /Library/Application Support/com.apple.TCC/, which lists each client app and the service it was granted
d) The user's KnowledgeC.db activity store, which records app usage and focus history
Answers:
|
Question: 01 Answer: c |
Question: 02 Answer: b |
Question: 03 Answer: c |
Question: 04 Answer: a |
Question: 05 Answer: b |
|
Question: 06 Answer: a |
Question: 07 Answer: c |
Question: 08 Answer: a, b, e |
Question: 09 Answer: d |
Question: 10 Answer: c |
Note: For any error in GIAC Enterprise Incident Response (GEIR) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
