In an enterprise incident response team, which role is typically responsible for coordinating communication with external parties such as law enforcement and regulatory bodies?

Public Relations / Communications Lead

What is the primary purpose of an incident response policy in an enterprise environment?

To establish the high-level authority, scope, and objectives for the incident response program

To document the technical details of a specific incident after it has been resolved

To assign specific tasks to individual incident responders during an active incident

To provide step-by-step technical instructions for handling specific types of incidents

A financial services company is responding to an insider threat incident where an employee allegedly stole customer data. The company's legal counsel has advised that the incident may involve law enforcement and regulatory reporting. The IR team is collecting evidence from the employee's workstation. Which action is most appropriate regarding evidence handling?

Allow the employee's manager to review the files first to confirm the theft.

Preserve the workstation as evidence, document the chain of custody, and coordinate with legal before any analysis.

Delete the employee's user profile to prevent further access to sensitive data.

Copy the entire hard drive to the employee's personal cloud storage for safekeeping.

A company's primary data center is flooded, and the disaster recovery (DR) site is activated. During the DR activation, the IR team discovers that the flood was caused by a cyber-physical attack that also compromised the DR site's management interface. What is the most important consideration for the IR team?

Focus only on restoring business operations and ignore the cyber-physical attack.

Coordinate with the DR team to ensure the DR site is clean before restoring operations, and treat the incident as an active IR.

Immediately fail back to the primary data center as soon as the flood water recedes.

Assume the DR site is secure because it is a separate facility.

Which component is typically included in an enterprise incident response procedure but NOT in the incident response policy?

The mission statement of the incident response program

The authority granted to the incident response team to take action

The specific order of steps to contain a malware outbreak

The roles and responsibilities of the incident response team

GIAC Certified Forensic Analyst

Domain 1Objective 1

Enterprise Environment Incident Response GCFA Practice Questions (Page 2)

Part of the Incident Response Fundamentals domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 8–14 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

Questions 6–10

6foundation · easy
In an enterprise incident response team, which role is typically responsible for coordinating communication with external parties such as law enforcement and regulatory bodies?
Select an answer first
7foundation · easy
What is the primary purpose of an incident response policy in an enterprise environment?
Select an answer first
8application · medium
A financial services company is responding to an insider threat incident where an employee allegedly stole customer data. The company's legal counsel has advised that the incident may involve law enforcement and regulatory reporting. The IR team is collecting evidence from the employee's workstation. Which action is most appropriate regarding evidence handling?
Select an answer first
9application · medium
A company's primary data center is flooded, and the disaster recovery (DR) site is activated. During the DR activation, the IR team discovers that the flood was caused by a cyber-physical attack that also compromised the DR site's management interface. What is the most important consideration for the IR team?
Select an answer first
10foundation · easy
Which component is typically included in an enterprise incident response procedure but NOT in the incident response policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

Enterprise Environment Incident Response GCFA Practice Questions (Page 2)

Questions 6–10

In an enterprise incident response team, which role is typically responsible for coordinating communication with external parties such as law enforcement and regulatory bodies?

What is the primary purpose of an incident response policy in an enterprise environment?

Which component is typically included in an enterprise incident response procedure but NOT in the incident response policy?

Keep studying — Incident Response Fundamentals