A small business has a single IT administrator who receives an alert about a potential breach. The administrator is unsure whether the alert is a true incident or a false positive. According to incident assessment fundamentals, what should the administrator do first?

Immediately disconnect all systems from the network to contain the potential breach.

Ignore the alert because the business is too small to be a target.

Contact law enforcement before doing any internal assessment.

Perform a quick triage to determine the severity and potential impact of the alert.

What is the primary goal of initial triage in incident response?

To quickly determine the severity and prioritize the response

To assign a permanent classification for legal purposes

To collect all evidence in a forensically sound manner

To contain the incident to prevent further damage

A hospital's IT team is responding to two simultaneous incidents. Incident A: A ransomware infection on a research server containing non-critical data, but the infection is spreading slowly. Incident B: A suspected data breach of the patient portal, where a small number of patient records may have been accessed. The hospital has limited incident response staff. The incident commander must prioritize. What is the most appropriate prioritization?

Prioritize Incident B because patient data exposure has immediate legal and reputational consequences.

Prioritize Incident A because ransomware can spread and cause widespread damage.

Prioritize Incident A because it is actively spreading, while Incident B is only suspected.

Prioritize both equally because both are security incidents.

A financial services firm discovers that an employee's laptop was stolen. The laptop contained unencrypted client financial data. The incident response team is collecting evidence. Which evidence collection action is most important for this incident?

Immediately notify all clients that their data may have been compromised.

Request the employee's password to access the laptop remotely.

Collect the employee's recent email communications to understand their activities.

Document the laptop's serial number, the employee's last known location, and the time of the theft report.

During initial triage, which factor is most important for determining the priority of an incident?

The time of day the incident was reported

The name of the system that reported the incident

The number of security tools that generated alerts

The potential impact on critical business operations

GIAC Cyber Incident Leader

Domain 3Objective 1

Incident Assessment GCIL Practice Questions (Page 2)

Part of the Incident Assessment and Tracking domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

7concepts

Questions 6–10

6application · medium
A small business has a single IT administrator who receives an alert about a potential breach. The administrator is unsure whether the alert is a true incident or a false positive. According to incident assessment fundamentals, what should the administrator do first?
Select an answer first
7foundation · easy
What is the primary goal of initial triage in incident response?
Select an answer first
8expert · hard
A hospital's IT team is responding to two simultaneous incidents. Incident A: A ransomware infection on a research server containing non-critical data, but the infection is spreading slowly. Incident B: A suspected data breach of the patient portal, where a small number of patient records may have been accessed. The hospital has limited incident response staff. The incident commander must prioritize. What is the most appropriate prioritization?
Select an answer first
9application · medium
A financial services firm discovers that an employee's laptop was stolen. The laptop contained unencrypted client financial data. The incident response team is collecting evidence. Which evidence collection action is most important for this incident?
Select an answer first
10foundation · easy
During initial triage, which factor is most important for determining the priority of an incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.