During which phase of the incident response lifecycle would an organization conduct a lessons-learned review and update its incident response plan based on findings?

Containment, Eradication, and Recovery

An IR team is reviewing its performance after a series of incidents. The team wants to identify areas for improvement. They have data on detection time, containment time, eradication time, and recovery time for each incident. Which analysis would best help the team identify whether their detection tools are effective?

Compare the number of false positives generated by the SIEM.

Compare the mean detection time across incidents and analyze trends over time.

Compare the total number of incidents handled each month.

Compare the recovery time for each incident.

Your organization is updating its incident response policy. The CISO wants to ensure that the policy supports both rapid response and business continuity during a major disruption. Which component is most critical to include in the policy to achieve this?

Clear escalation paths and decision authority for activating business continuity plans.

A requirement to preserve all logs for at least seven years.

A mandate to use only open-source tools for all forensic acquisitions.

A detailed list of forensic tools and their command-line syntax.

A security incident has been declared. The incident response team includes members from IT, legal, HR, and public relations. Which role is primarily responsible for determining whether law enforcement should be notified?

The HR representative, because they handle employee-related matters.

The legal counsel, in coordination with executive leadership.

The IT team lead, because they understand the technical details.

The public relations manager, because they handle external communications.

An organization's incident response policy requires that all incidents be reported to the CISO within one hour. However, during a weekend incident, the on-call analyst discovers that the CISO is unreachable. The policy does not specify an alternate escalation path. What is the best course of action?

Report the incident to the next level of management as defined in the general organizational hierarchy.

Wait until the CISO is available to report the incident.

Handle the incident quietly and avoid escalation to prevent panic.

Document the incident and include it in the next weekly report.

GIAC Certified Forensic Analyst

Domain 1Objective 1

Enterprise Environment Incident Response GCFA Practice Questions (Page 5)

Part of the Incident Response Fundamentals domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 8–14 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

Questions 21–25

21foundation · easy
During which phase of the incident response lifecycle would an organization conduct a lessons-learned review and update its incident response plan based on findings?
Select an answer first
22expert · hard
An IR team is reviewing its performance after a series of incidents. The team wants to identify areas for improvement. They have data on detection time, containment time, eradication time, and recovery time for each incident. Which analysis would best help the team identify whether their detection tools are effective?
Select an answer first
23application · medium
Your organization is updating its incident response policy. The CISO wants to ensure that the policy supports both rapid response and business continuity during a major disruption. Which component is most critical to include in the policy to achieve this?
Select an answer first
24application · medium
A security incident has been declared. The incident response team includes members from IT, legal, HR, and public relations. Which role is primarily responsible for determining whether law enforcement should be notified?
Select an answer first
25expert · hard
An organization's incident response policy requires that all incidents be reported to the CISO within one hour. However, during a weekend incident, the on-call analyst discovers that the CISO is unreachable. The policy does not specify an alternate escalation path. What is the best course of action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

Enterprise Environment Incident Response GCFA Practice Questions (Page 5)

Questions 21–25

During which phase of the incident response lifecycle would an organization conduct a lessons-learned review and update its incident response plan based on findings?

Your organization is updating its incident response policy. The CISO wants to ensure that the policy supports both rapid response and business continuity during a major disruption. Which component is most critical to include in the policy to achieve this?

A security incident has been declared. The incident response team includes members from IT, legal, HR, and public relations. Which role is primarily responsible for determining whether law enforcement should be notified?

Keep studying — Incident Response Fundamentals