Incident Communications GCIL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After a major incident, the incident commander is leading a post-incident review focused on communications. Which activity is MOST effective for evaluating the communication plan's effectiveness?

   • ARewarding the team for a successful incident regardless of communication issues
   • BDeleting all communication logs to protect privacy
   • CComparing the actual communication timeline against the planned escalation and update schedule
   • DAsking only the technical team if they felt informed
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of an escalation procedure in incident communication?

   • ATo ensure that all communication is sent through a single person
   • BTo ensure that the right people are notified promptly as the severity or impact of the incident changes
   • CTo delay communication until the incident is fully understood
   • DTo ensure that only technical staff are involved in communication
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst needs to explain a phishing attack to a non-technical employee who clicked a malicious link. Which explanation best translates the technical details while preserving accuracy?

   • AThe email you clicked contained a link that installed malicious software on your computer. We are removing it and checking for any data access.
   • BThe email was a scam, but we have fixed it. You don't need to worry.
   • CYou were hacked, and your computer is now part of a botnet.
   • DThe email contained a URL that redirected to a drive-by download exploit kit, which dropped a remote access trojan.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial services firm has an escalation procedure that requires notifying the Chief Information Security Officer (CISO) within 1 hour of a confirmed data breach, and the state regulator within 72 hours. A breach is confirmed at 2:00 PM. The incident commander is busy containing the breach. What should the incident commander do?

   • AWait until containment is complete before notifying the CISO and regulator to avoid inaccurate reporting.
   • BSend a single notification to both the CISO and regulator at the same time, after gathering all details.
   • CDelegate the CISO notification to a deputy, and set a reminder to notify the regulator within the 72-hour window.
   • DNotify the regulator first, then the CISO, because the regulator has a longer deadline.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A global company has offices in multiple time zones. During a major incident, the incident commander must ensure that executives in different regions receive timely updates. The communication plan must account for time zone differences and the availability of key stakeholders. Which approach is most effective?

   • APost updates on an internal wiki page, and ask executives to check it regularly.
   • BSchedule updates at a fixed time each day, regardless of time zone, to ensure consistency.
   • CUse a 24/7 on-call rotation for executive communication, with a designated contact for each region who can be reached at any time.
   • DSend all updates to a single global email distribution list, and rely on executives to read them when they wake up.
   Reveal Solution Discussion Select an answer first