Free GIAC GCED Exam Dumps Questions & Answers

The creation of a filesystem timeline is associated with which objective?

• A.First response
• B.Incident eradication
• C.Access control
• D.Forensic analysis

When identifying malware, what is a key difference between a Worm and a Bot?

• A.A Bot, unlike a Worm, is frequently spread through email attachments.
• B.A Worm, unlike a Bot, is installed silently as an add-on to a legitimate program.
• C.A Bot gets instructions from an external control channel like an IRC server.
• D.A Worm gets instructions from an external control channel like an IRC server.

Which of the following is the best way to establish and verify the integrity of a file before copying it during an investigation?

• A.Ensure that the MAC times are identical before and after copying the file
• B.Create hash of the file before and after copying the image verifying they are identical
• C.Write down the file size of the file before and after copying and ensure they match
• D.Establish the chain of custody with the system description to prove it is the same image

Which of the following is best defined as "anything that has the potential to target known or existing vulnerabilities in a system?"

• A.Exploit
• B.Threat
• C.Vector
• D.Gateway

An incident response team is handling a worm infection among their user workstations. They created an IPS signature to detect and block worm activity on the border IPS, then removed the worm's artifacts or workstations triggering the rule. Despite this action, worm activity continued for days after. Where did the incident response team fail?

• A.The custom rule did not detect all infected workstations
• B.The team did not adequately apply lessons learned from the incident
• C.The team did not understand the worm's propagation method
• D.They did not receive timely notification of the security event