GEIR Exam Training Practice Tests (GIAC Enterprise Incident Response)]

Question 1

Which tool is primarily used for detailed investigation of the filesystem in Linux DFIR tasks?
Response:

A. Debugfs B. Sed C. Awk D. Grep

Correct Answer: A

Question 2

What are effective practices for maintaining enterprise visibility to support incident scoping?
Response:

A. Regular data purging to free up storage space B. Continuous monitoring of network traffic C. Periodic manual audits of security settings D. Integrating SIEM solutions for real-time analysis

Correct Answer: B,D

Question 3

Which strategy is MOST effective in managing the complexity of a large-scale digital forensic investigation in a multinational corporation?
Response:

A. Employing distributed teams using standardized procedures and tools B. Conducting investigations remotely without onsite forensic capability C. Relying solely on external law enforcement resources D. Centralizing all data to a single location for analysis

Correct Answer: A

Question 4

Which of the following best describes 'Infrastructure as a Service' (IaaS)?
Response:

A. It offers complete software solutions on a pay-as-you-go basis B. It provides virtualized computing resources over the internet C. It is primarily for data storage services D. It includes development tools but not the operating systems

Correct Answer: B

Question 5

Which of the following is a foundational strategy for responding to a container-based incident?
Response:

A. Patching all software immediately B. Ignoring the incident C. Following a pre-defined incident response plan D. Shutting down the entire network

Correct Answer: C

Question 6

Select the types of logs that would be most helpful in scoping a data exfiltration incident.
Response:

A. Change management logs B. Web application firewall logs C. System event logs D. Server load balancer logs E. Network flow data

Correct Answer: B,C,E

GIAC Enterprise Incident Response - GEIR Exam Practice Test