Incident Assessment GCIL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is documentation of assessment activities important for post-incident review?

   • AIt ensures that all incidents are automatically resolved
   • BIt is only required for legal purposes
   • CIt provides a record of what was done and learned for future improvements
   • DIt replaces the need for incident response training
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A manufacturing company discovers that a compromised vendor account was used to access a project management system containing proprietary product designs. The vendor had access to only one project folder. The company's legal team needs to know the potential impact. What is the most important factor to communicate?

   • AThe operating system version of the project management server
   • BThe vendor's contract renewal date
   • CThe number of login attempts made by the compromised account
   • DThe specific project folder accessed and whether the designs were downloaded or modified
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company's incident response team is assessing a breach that affected a legacy system containing employee records. The system is scheduled for decommissioning in two months. The breach exposed names and social security numbers. The team must communicate the impact to the executive team. What is the most important impact to communicate?

   • AThe cost of decommissioning the legacy system early.
   • BThe technical details of how the breach occurred.
   • CThe fact that the system was scheduled for decommissioning anyway.
   • DThe regulatory and reputational impact of exposing employee PII.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of 'actual impact' during an incident assessment?

   • AA system that has been confirmed to be encrypted by ransomware
   • BA vulnerability that could be exploited in the future
   • CA hypothetical scenario of a power outage affecting the data center
   • DA risk that a data breach might occur if the attacker gains more access
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company's incident response team is investigating a suspected insider threat. An employee is suspected of downloading sensitive documents to a personal USB drive. The team has identified the employee's workstation. The legal team wants to preserve evidence for potential disciplinary action. What is the most appropriate action?

   • AMonitor the employee's activity to gather more evidence before acting.
   • BSeize the workstation and create a forensic image of the hard drive.
   • CAsk the employee's manager to search the workstation.
   • DConfront the employee immediately and ask them to return the USB drive.
   Reveal Solution Discussion Select an answer first