GIAC Certified Enterprise Defender

Which type of media should the IR team be handling as they seek to understand the root cause of an incident?

An incident response team is handling a worm infection among their user workstations. They created an IPS signature to detect and block worm activity on the border IPS, then removed the worms artifacts or workstations triggering the rule. Despite this action, worm activity continued for days after. Where did the incident response team fail?

A legacy server on the network was breached through an OS vulnerability with no patch available. The server is used only rarely by employees across several business units. The theft of information from the server goes unnoticed until the company is notified by a third party that sensitive information has been posted on the Internet. Which control was the first to fail?

Analyze the screenshot below. Which of the following attacks can be mitigated by these configuration settings?

Of the following pieces of digital evidence, which would be collected FIRST from a live system involved in an incident?