Incident Communications GCIL Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a widespread phishing campaign, a company's security team needs to communicate with three groups: employees (non-technical), the IT help desk (technical), and the executive team. Which channel and message combination is most appropriate?

   • AA phone call to each employee, followed by a detailed written report for the executives
   • BA single message on the company intranet with all technical details for everyone to review
   • CA company-wide email with simple language telling employees what to do, a separate technical bulletin for the help desk, and a brief executive summary
   • DEmail to all employees with detailed indicators of compromise (IOCs) and technical analysis
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services firm has a communication escalation procedure that requires notifying the Chief Risk Officer (CRO) within 30 minutes of confirming a breach involving customer financial data. The incident commander has just confirmed such a breach. Which action should the incident commander take FIRST?

   • APost the breach details on the internal social platform for all employees to see
   • BWait for the next scheduled daily status meeting to report the breach
   • CNotify the CRO immediately using the designated escalation channel (e.g., phone or secure messaging)
   • DSend a detailed technical report to the IT security team for review before any notification
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A manufacturing company's IT and OT networks are both affected by a malware outbreak. The incident commander must communicate with the plant floor supervisors (non-technical) and the IT security team (technical). The plant floor is noisy, and supervisors may not have easy access to email. Which communication approach is most effective?

   • ASend a detailed technical email to the IT security team, and use a public address system announcement for the plant floor supervisors.
   • BUse the same email for both groups, with technical details included for the IT team and a summary for the supervisors.
   • CSend a text message to the plant floor supervisors with simple instructions, and a technical email to the IT security team.
   • DHold a video conference with both groups, and share the technical details on the screen.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst must explain a SQL injection attack to a non-technical business manager. Which explanation best translates the technical details while preserving accuracy?

   • AOur database was hacked, and we are not sure what happened.
   • BA hacker broke into our system and stole everything. We are working on it.
   • CAn attacker inserted malicious code into our database query, allowing them to bypass authentication and access customer records.
   • DThe attacker used a UNION-based SQL injection to extract data from the information_schema database.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a malware incident, the incident commander must provide a status update to the company's legal counsel, who is not technical. Which update is MOST appropriate?

   • AWe are working with the FBI and will provide a report when the investigation is complete.
   • BEverything is fine; we will let you know if anything changes.
   • CThe malware is a polymorphic trojan that uses process injection and is communicating with a known C2 domain; we are analyzing the memory dumps.
   • DWe have identified malicious software on several computers that may have accessed sensitive legal documents; we have isolated the affected systems and are determining the scope of access.
   Reveal Solution Discussion Select an answer first