An incident response team is documenting a data breach that involved the exfiltration of customer data. The team is creating the final incident report. Which element is most important to include to support potential legal proceedings?

The names of all employees who were involved in the investigation.

A summary of the incident for the company's annual report.

A detailed chain of custody for all evidence collected during the investigation.

A list of all software versions used on the affected systems.

Which action is appropriate when collecting evidence from a compromised system?

Power off the system immediately to preserve the evidence

Run antivirus scans to clean the system

Create a forensic image of the system's storage

Delete suspicious files to prevent further damage

GIAC Cyber Incident Leader

Domain 3Objective 1

Incident Assessment GCIL Practice Questions (Page 10)

Part of the Incident Assessment and Tracking domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

7concepts

Questions 46–48

46foundation · easy
Which stakeholder group is most likely to need a high-level summary of incident impact rather than technical details?
Select an answer first
47expert · hard
An incident response team is documenting a data breach that involved the exfiltration of customer data. The team is creating the final incident report. Which element is most important to include to support potential legal proceedings?
Select an answer first
48foundation · easy
Which action is appropriate when collecting evidence from a compromised system?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Incident Assessment GCIL Practice Questions (Page 10)

Questions 46–48

Which stakeholder group is most likely to need a high-level summary of incident impact rather than technical details?

An incident response team is documenting a data breach that involved the exfiltration of customer data. The team is creating the final incident report. Which element is most important to include to support potential legal proceedings?

Which action is appropriate when collecting evidence from a compromised system?

Keep studying — Incident Assessment and Tracking