Review 88 GCED practice questions with answer explanations and community insights.
Question 1
Which type of media should the IR team be handling as they seek to understand the root cause of an incident?
Restored media from full backup of the infected host
Media from the infected host, copied to the dedicated IR host
Original media from the infected host
Bit-for-bit image from the infected host
Question 2
An incident response team is handling a worm infection among their user workstations. They created an IPS signature to detect and block worm activity on the border IPS, then removed the worms artifacts or workstations triggering the rule. Despite this action, worm activity continued for days after. Where did the incident response team fail?
The team did not adequately apply lessons learned from the incident
The custom rule did not detect all infected workstations
They did not receive timely notification of the security event
The team did not understand the worm’s propagation method
Question 3
A legacy server on the network was breached through an OS vulnerability with no patch available. The server is used only rarely by employees across several business units. The theft of information from the server goes unnoticed until the company is notified by a third party that sensitive information has been posted on the Internet. Which control was the first to fail?
Security awareness
Access control
Data classification
Incident response
Question 4
Analyze the screenshot below. Which of the following attacks can be mitigated by these configuration settings?
A Denial-of-Service attack using network broadcasts
A Replay attack
An IP masquerading attack
A MAC Flood attack
Question 5
Of the following pieces of digital evidence, which would be collected FIRST from a live system involved in an incident?