GIAC GCIH QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Section 1: Incident Handling Fundamentals (Q1–Q15)
Q1. What are the six steps of the SANS Incident Handling process, in order?
A) Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned
B) Identification, Preparation, Containment, Recovery, Eradication, Lessons Learned
C) Preparation, Containment, Identification, Eradication, Recovery, Lessons Learned
D) Detection, Analysis, Containment, Eradication, Recovery, Reporting
Answer: A
Rationale: The SANS PICERL model is: Preparation, Identification, Containment, Eradication, Recovery,
Lessons Learned. Order matters — preparation comes first, and lessons learned is always last.
,Q2. During which phase of incident handling would you first determine whether an event is actually a security
incident?
A) Preparation
B) Identification
C) Containment
D) Eradication
Answer: B
Rationale: The Identification phase is where you validate whether an event is a true incident, determine its
scope, and begin documentation.
Q3. What is the primary purpose of the Preparation phase?
A) To remove malware from infected systems
B) To establish tools, processes, and training before an incident occurs
C) To notify law enforcement
D) To restore systems from backup
, Answer: B
Rationale: Preparation is about readiness — policies, tools, jump kits, communication plans, and training — so
the team can respond effectively when an incident occurs.
Q4. Which of the following is the BEST example of a "jump kit" item?
A) A signed acceptable use policy
B) A write-blocker and forensic workstation
C) The company's org chart
D) A press release template
Answer: B
Rationale: A jump kit contains the hardware and software tools needed for immediate response — forensic
workstations, write-blockers, cables, blank media, etc.
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Section 1: Incident Handling Fundamentals (Q1–Q15)
Q1. What are the six steps of the SANS Incident Handling process, in order?
A) Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned
B) Identification, Preparation, Containment, Recovery, Eradication, Lessons Learned
C) Preparation, Containment, Identification, Eradication, Recovery, Lessons Learned
D) Detection, Analysis, Containment, Eradication, Recovery, Reporting
Answer: A
Rationale: The SANS PICERL model is: Preparation, Identification, Containment, Eradication, Recovery,
Lessons Learned. Order matters — preparation comes first, and lessons learned is always last.
,Q2. During which phase of incident handling would you first determine whether an event is actually a security
incident?
A) Preparation
B) Identification
C) Containment
D) Eradication
Answer: B
Rationale: The Identification phase is where you validate whether an event is a true incident, determine its
scope, and begin documentation.
Q3. What is the primary purpose of the Preparation phase?
A) To remove malware from infected systems
B) To establish tools, processes, and training before an incident occurs
C) To notify law enforcement
D) To restore systems from backup
, Answer: B
Rationale: Preparation is about readiness — policies, tools, jump kits, communication plans, and training — so
the team can respond effectively when an incident occurs.
Q4. Which of the following is the BEST example of a "jump kit" item?
A) A signed acceptable use policy
B) A write-blocker and forensic workstation
C) The company's org chart
D) A press release template
Answer: B
Rationale: A jump kit contains the hardware and software tools needed for immediate response — forensic
workstations, write-blockers, cables, blank media, etc.
