After a major incident, the incident commander is conducting a post-incident review. The communication team reports that some stakeholders received conflicting information because different channels were used. Which action is MOST effective to prevent this in future incidents?

Send all updates via email only, and avoid other channels

Use a single communication channel for all stakeholders to ensure consistency

Limit communication to only the incident commander to avoid conflicting messages

Establish a single source of truth for incident status and require all communications to be approved against it before sending

A utility company has a communication escalation procedure that requires notifying the state regulator within 4 hours of a cyber incident affecting operational technology. The incident commander has confirmed an incident that could affect the water treatment control system. What should the incident commander do FIRST?

Send a public statement to the media first

Ask the legal team to determine if the incident is reportable before any notification

Notify the regulator using the designated channel with the information available, even if incomplete

Wait until the full technical investigation is complete before notifying the regulator

What is the most important characteristic of an effective incident status update?

It is clear, concise, and accurately reflects the current situation, impact, and next steps

It is written in a way that minimizes the severity of the incident

It includes every technical detail discovered so far

It is sent only when the incident is fully resolved

GIAC Cyber Incident Leader

Domain 5Objective 1

Incident Communications GCIL Practice Questions (Page 11)

Part of the Communication and Reporting domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 51–53

51expert · hard
After a major incident, the incident commander is conducting a post-incident review. The communication team reports that some stakeholders received conflicting information because different channels were used. Which action is MOST effective to prevent this in future incidents?
Select an answer first
52application · medium
A utility company has a communication escalation procedure that requires notifying the state regulator within 4 hours of a cyber incident affecting operational technology. The incident commander has confirmed an incident that could affect the water treatment control system. What should the incident commander do FIRST?
Select an answer first
53foundation · easy
What is the most important characteristic of an effective incident status update?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Incident Communications GCIL Practice Questions (Page 11)

Questions 51–53

After a major incident, the incident commander is conducting a post-incident review. The communication team reports that some stakeholders received conflicting information because different channels were used. Which action is MOST effective to prevent this in future incidents?

What is the most important characteristic of an effective incident status update?

Keep studying — Communication and Reporting