Free GCED Practice Questions

Question 1

A SOC analyst confirms that a finance workstation is beaconing to a known command-and-control host. The system is powered on, a user is logged in, and management wants the threat stopped immediately. Legal has indicated the incident may lead to prosecution. Which action should the responder take FIRST?

Accepted Answer

Remove the workstation from the network while leaving it powered on

Answer

Shut the workstation down so the malware cannot cause further damage

Answer

Reimage the workstation from a known-good baseline and return it to the user

Answer

Run a full antivirus scan and quarantine whatever the scanner identifies

Question 2

Following RFC 3227 guidance on the order of volatility, which of the following sources should be collected EARLIEST during live evidence acquisition?

Accepted Answer

The ARP cache on the running system

Answer

The contents of the system hard disk

Answer

Log data already forwarded to the SIEM

Answer

Backup tapes held in archival storage

Question 3

An analyst is reviewing the following Snort rule:

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"SMB exploit attempt"; flow:established,to_server; content:"|FF|SMB"; sid:1000042; rev:1;)

Which traffic will cause this rule to generate an alert?

Accepted Answer

Traffic from an external host into the internal network on port 445, within an established session, flowing toward the server

Answer

Traffic in either direction between the internal and external networks on port 445, since content matching is bidirectional

Answer

Any packet arriving from the external network on port 445 that contains the matching content, whether or not a session exists

Answer

Traffic sent from an internal host on port 445 outbound to an external server within an established session

Question 4

A suspicious executable pulled from a compromised host is submitted to an automated sandbox. The report comes back with no network activity, no file writes, and no registry changes. Static properties analysis, however, shows a high-entropy code section and imports for VirtualAlloc and IsDebuggerPresent. What is the MOST likely explanation?

Accepted Answer

The specimen detected the analysis environment and suppressed its malicious behavior

Answer

The specimen is benign, because behavioral analysis produced no malicious indicators

Answer

The sandbox needs to be re-run with a longer timeout to capture delayed execution

Answer

The file was corrupted in transit and failed to execute inside the sandbox

Question 5

After an ARP spoofing incident on a user VLAN, an engineer enables Dynamic ARP Inspection (DAI) on the access switches. Users on that VLAN immediately lose connectivity, and the switch logs show ARP packets being dropped on ports connected to legitimate hosts. What is the MOST likely cause?

Accepted Answer

DHCP snooping is not enabled, so DAI has no binding table to validate against

Answer

The uplink ports to the distribution switches were configured as untrusted

Answer

DAI cannot be enabled on access ports and must be applied at the router

Answer

The switch requires port security to be configured before DAI will pass traffic

Question 6

During an investigation spanning a firewall, a database server, and a web proxy, an analyst finds that the SIEM displays all three sources in a consistent time zone, yet the reconstructed timeline shows the outbound transfer occurring BEFORE the database query that produced the data. What is the MOST likely root cause?

Accepted Answer

The source system clocks are not synchronized to a common time reference

Answer

The SIEM is failing to normalize time zone offsets as the logs are ingested

Answer

The proxy records timestamps in UTC while the SIEM renders them in local time

Answer

The SIEM's correlation window is too narrow to sequence these events correctly

Question 7

A candidate studying incident response reads that the NIST incident response lifecycle consists of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Which statement about this model is correct as of 2026?

Accepted Answer

It comes from Revision 2, which Revision 3 superseded in 2025 by realigning to CSF 2.0

Answer

It remains NIST's current lifecycle, and the SANS six-step process is merely a renaming of it

Answer

It comes from Revision 3, which split the middle phase and added Lessons Learned as a fifth

Answer

It was never a NIST model; the four-phase lifecycle has always been attributed to SANS

Question 8

An analyst runs both windows.pslist and windows.psscan against the same memory image. A process named svchost.exe with PID 3120 appears in the psscan output but does not appear in the pslist output. Which conclusion is BEST supported?

Accepted Answer

The process was deliberately unlinked from the active process list

Answer

The psscan plugin produced a false positive by misreading a pool tag

Answer

The memory image was captured incorrectly and should be re-acquired

Answer

The process started after pslist ran and was captured only by the later psscan pass

Question 9

A network security monitoring sensor running Zeek observes an internal host opening a single long-lived TLS session to an unfamiliar external IP address. Corporate policy prohibits TLS interception. Which approach will BEST support a determination that data is being exfiltrated?

Accepted Answer

Review conn.log for byte-volume asymmetry and ssl.log for the JA3 fingerprint and certificate details

Answer

Escalate for approval to deploy inline TLS interception, as encrypted sessions cannot be assessed otherwise

Answer

Block all outbound TLS to destinations not on the corporate allow list and observe whether the transfer stops

Answer

Note the session as unresolvable, since payload inspection is the only reliable evidence of exfiltration

Question 10

A scanner reports a vulnerability with a CVSS v3.1 Base Score of 9.8 on a server. The server is isolated on an air-gapped segment with no inbound routing from any other network. Which CVSS metric group is designed to let the organization reflect these local conditions in the score?

Accepted Answer

The Environmental metric group

Answer

The Temporal metric group, because the exposure changes over time

Answer

The Base metric group, recalculated with a reduced Attack Vector value

Answer

None; the Base Score is authoritative and must be used as published by the vendor

Free GCED Practice Questions

Domain 1: Defending Network Protocols

Question 1

Domain 3: Digital Forensics Concepts and Application

Question 2

Question 3

Domain 4: Incident Response Concepts and Application

Question 4

Question 5

Domain 6: Intrusion Detection and Packet Analysis

Question 6

Domain 7: Malware Analysis Concepts and Basic Analysis Techniques

Question 7

Domain 8: Network Forensics, Logging, and Event Management

Question 8

Domain 9: Network Security Monitoring Concepts and Application

Question 9

Domain 11: Penetration Testing Concepts

Question 10

The rest of the GCED blueprint

That's 10 of 1,050