After a major incident, the incident commander conducts a post-incident review of communications. Which finding indicates a need for improvement in the communication plan?

Stakeholders received updates at the planned intervals, and the content was accurate.

The executive team received a technical briefing that they found difficult to understand.

The communication channels were available and functioned without issues.

The incident commander used the predefined templates for status updates.

Which approach is most effective when explaining a malware infection to a non-technical manager?

Describe the infection as a 'computer virus that may have accessed sensitive files' and explain the potential business impact

Explain the specific malware family, its hash values, and the exploitation technique used

Avoid mentioning the incident until it is fully resolved

State that 'the endpoint was compromised via a spear-phishing campaign using a polymorphic payload' without further explanation

Which activity is part of a post-incident communication review?

Deleting all chat logs from the incident to free up storage

Rewarding the team members who communicated the most

Creating a new incident response plan from scratch

Gathering feedback from stakeholders on the clarity and timeliness of updates

Which factor is most important when prioritizing stakeholders for incident communication?

The stakeholder's physical location relative to the incident

The stakeholder's role and the potential impact of the incident on their operations or responsibilities

The stakeholder's seniority in the organizational hierarchy

The stakeholder's personal relationship with the incident commander

During the development of an incident communication plan, which element is most essential to include to ensure timely and effective updates?

A predefined list of stakeholders, their preferred communication channels, and the timing for each update

A detailed technical analysis of the incident root cause

A list of all possible malware signatures that might be encountered

A backup of all system logs for forensic purposes

GIAC Cyber Incident Leader

Domain 5Objective 1

Incident Communications GCIL Practice Questions (Page 10)

Part of the Communication and Reporting domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 46–50

46application · medium
After a major incident, the incident commander conducts a post-incident review of communications. Which finding indicates a need for improvement in the communication plan?
Select an answer first
47foundation · easy
Which approach is most effective when explaining a malware infection to a non-technical manager?
Select an answer first
48foundation · easy
Which activity is part of a post-incident communication review?
Select an answer first
49foundation · easy
Which factor is most important when prioritizing stakeholders for incident communication?
Select an answer first
50foundation · easy
During the development of an incident communication plan, which element is most essential to include to ensure timely and effective updates?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.