GIAC Enterprise Incident Response Sample Questions:

1. On macOS, where can you find system application logs?
Response:

A) Logger.app
B) Syslog.app
C) Console.app
D) Terminal.app

2. Which tool is primarily used for detailed investigation of the filesystem in Linux DFIR tasks?
Response:

A) Debugfs
B) Sed
C) Awk
D) Grep

3. How should an incident response team address the challenge of scaling their operations during a widespread malware infection across multiple organizational units?
Response:

A) Through pre-defined escalation procedures and role-based task assignments
B) Limiting the response to only critical systems and assets
C) By shutting down all operations until the malware is contained
D) By temporarily hiring external consultants to manage the workload

4. Which command-line tool can be used to manage and automate tasks in a cloud environment?
Response:

A) AWS CLI
B) curl
C) ping
D) traceroute

5. Which of the following is a recommended manual technique for identifying malicious activity in a cloud environment?
Response:

A) Running antivirus software
B) Reviewing audit logs
C) Automated script analysis
D) Installing new cloud instances

Solutions: