SANS GCIH (SEC504) EXAM QUESTIONS AND
ACCURATE ANSWERS | NEWEST UPDATE 2026/2027 |
GRADED A+.
Which of the following groups should decide when a system is put back into production?
A) Systems administrators
B) Business team
C) Security team
D) Data owner - Answer B) Business team
Which of the following would display ASCII and Unicode strings in a malware sample?
A) cat
B) Get-Strings
C) strings
D) findstr - Answer C) strings
Which of the following is typically used to carry out an investigation by most malware
investigators?
A) Virtual machine
B) Day-to-day host
C) Thick client
D) Production system - Answer A) Virtual machine
If you believe your system has been subjected to a rootkit attack, which of the following
is the least expensive form of removal?
A) Restore the OS from the most recent backup.
B) Reformat, reinstall, and patch the system from the original media.
,C) Patch and reboot the compromised system.
D) Install applications from a different vendor. - Answer B) Reformat, reinstall, and patch
the system from the original media.
At the remediation phase of incident response, you have just deleted a file from your
infected web server. What's the most important additional thing to do in order not to get
compromised again?
A) Determine the root cause of the attack.
B) Rule analysis of your host-based firewall
C) Host data recovery using backup.
D) System hardening and patching. -Answer A) Determine the root cause of the attack.
Why RAM image analysis is a must for investigations?
A) There could be some valuable information in RAM, which may not exist on-disk.
b) Speed - A RAM image would contain the same information as disk.
c) RAM produces more reliable images than disk
d) Historical data is easier to find in RAM than searching disk. -Answer A) There is useful
data in RAM that may not be stored on disk.
,Thank you for Purchasing this exam
Study Guide. We provide high-quality
academic materials to help students
excel in exams. Our other Services
include but not limited to: academic
research, University & College
assignments writing, essay writing,
Online Classes, and research
projects. Our services are reliable,
affordable, and plagiarism-free. All
the Best in your Exam. For more
information; Contact us at:
or
0R
+254 741484450
An investigator encounters the following POST. What Log type captured this activity?
1583050850.951 185 192.168.40.123 TCP_MISS/200 1856 POST
https://update.googleapis.com/service/update2? -ORIGINAL_DST/172.219.10.153 text/xml
A) Switch access log
B) Regshot event log
C) Proxy access log
, D) Windows event log - Answer C) Proxy access log
What tool can be utilized to document the registry state both before and after malware
has been executed on an analysis system?
A) Regshot
B) Ollydbg
C) Wireshark
D) Regripper - Answer A) Regshot
What can be done to make sure that an asset that is under investigation is not returned to
production prior to an investigation being completed?
A) The asset should be moved to a different cloud data center.
B) The asset should be terminated.
C) Lock down all administrative access to the cloud environment so none of the admins
can make changes.
D) Apply an "under investigation" tag to the asset. - Answer D) Apply an "under
investigation" tag to the asset.
What are two general methods usually undertaken in malware analysis?
A) Carrying out a penetration test and carrying out a vulnerability scan.
B) Observing the environment and performing code analysis.
C) Taking down the environment and restoring from backups.
D) Performing a risk assessment and checking on a potential exploit type. - Answer B)
Observing the environment and performing code analysis.
ACCURATE ANSWERS | NEWEST UPDATE 2026/2027 |
GRADED A+.
Which of the following groups should decide when a system is put back into production?
A) Systems administrators
B) Business team
C) Security team
D) Data owner - Answer B) Business team
Which of the following would display ASCII and Unicode strings in a malware sample?
A) cat
B) Get-Strings
C) strings
D) findstr - Answer C) strings
Which of the following is typically used to carry out an investigation by most malware
investigators?
A) Virtual machine
B) Day-to-day host
C) Thick client
D) Production system - Answer A) Virtual machine
If you believe your system has been subjected to a rootkit attack, which of the following
is the least expensive form of removal?
A) Restore the OS from the most recent backup.
B) Reformat, reinstall, and patch the system from the original media.
,C) Patch and reboot the compromised system.
D) Install applications from a different vendor. - Answer B) Reformat, reinstall, and patch
the system from the original media.
At the remediation phase of incident response, you have just deleted a file from your
infected web server. What's the most important additional thing to do in order not to get
compromised again?
A) Determine the root cause of the attack.
B) Rule analysis of your host-based firewall
C) Host data recovery using backup.
D) System hardening and patching. -Answer A) Determine the root cause of the attack.
Why RAM image analysis is a must for investigations?
A) There could be some valuable information in RAM, which may not exist on-disk.
b) Speed - A RAM image would contain the same information as disk.
c) RAM produces more reliable images than disk
d) Historical data is easier to find in RAM than searching disk. -Answer A) There is useful
data in RAM that may not be stored on disk.
,Thank you for Purchasing this exam
Study Guide. We provide high-quality
academic materials to help students
excel in exams. Our other Services
include but not limited to: academic
research, University & College
assignments writing, essay writing,
Online Classes, and research
projects. Our services are reliable,
affordable, and plagiarism-free. All
the Best in your Exam. For more
information; Contact us at:
or
0R
+254 741484450
An investigator encounters the following POST. What Log type captured this activity?
1583050850.951 185 192.168.40.123 TCP_MISS/200 1856 POST
https://update.googleapis.com/service/update2? -ORIGINAL_DST/172.219.10.153 text/xml
A) Switch access log
B) Regshot event log
C) Proxy access log
, D) Windows event log - Answer C) Proxy access log
What tool can be utilized to document the registry state both before and after malware
has been executed on an analysis system?
A) Regshot
B) Ollydbg
C) Wireshark
D) Regripper - Answer A) Regshot
What can be done to make sure that an asset that is under investigation is not returned to
production prior to an investigation being completed?
A) The asset should be moved to a different cloud data center.
B) The asset should be terminated.
C) Lock down all administrative access to the cloud environment so none of the admins
can make changes.
D) Apply an "under investigation" tag to the asset. - Answer D) Apply an "under
investigation" tag to the asset.
What are two general methods usually undertaken in malware analysis?
A) Carrying out a penetration test and carrying out a vulnerability scan.
B) Observing the environment and performing code analysis.
C) Taking down the environment and restoring from backups.
D) Performing a risk assessment and checking on a potential exploit type. - Answer B)
Observing the environment and performing code analysis.
