Incident Communications GCIL Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is writing a status update for the executive team about a malware infection that has affected the company's file servers. Which update best conveys the situation, impact, and next steps?

   • AThe malware is contained, and no action is needed. We will resume normal operations soon.
   • BWe have detected malware on our file servers. The malware is a variant of Emotet and is spreading via SMB. We are isolating the servers and running antivirus scans.
   • COur file servers are infected with malware, which may affect employee access to shared files. We are working to clean the servers and expect to restore access within 4 hours.
   • DWe are experiencing a malware incident. We will provide an update when we have more information.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a data breach investigation, the incident commander must send a status update to the company's non-technical executives. Which message BEST conveys the situation without overwhelming them with technical jargon?

   • AEverything is under control; no action needed from you at this time.
   • BThe attacker exploited a SQL injection vulnerability in the customer portal to exfiltrate records from the backend database.
   • COur WAF logs show a series of 200 OK responses to a malicious payload, indicating a possible injection attempt that we are correlating with database audit logs.
   • DAn unauthorized party gained access to our customer portal and may have copied customer records; we are assessing which records were affected and have contained the access.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A multinational corporation is responding to a ransomware attack that has encrypted files on servers in multiple regions. The incident commander must brief the CEO, who is concerned about the impact on quarterly earnings and the company's reputation. The CEO asks, 'Should we pay the ransom?' Which response is MOST appropriate for the incident commander to give?

   • AI will make the decision for you based on the technical details; you don't need to be involved.
   • BNo, we should never pay ransoms because it encourages more attacks.
   • CYes, paying the ransom is the fastest way to restore operations and minimize financial loss.
   • DWe have backups that may allow recovery without paying, but we are assessing the integrity of those backups and the legal implications of payment in the affected jurisdictions; I recommend we evaluate these options before deciding.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of a legal or regulatory communication requirement during an incident?

   • ANotifying a data protection authority within a specified timeframe after discovering a data breach
   • BInforming all employees about the incident within one hour
   • CPosting incident details on the company's social media accounts
   • DSending a press release to all media outlets immediately
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A university is responding to a data breach affecting student records. The incident commander needs to communicate with students, faculty, and the university's board of trustees. Which communication channel is MOST appropriate for the board of trustees?

   • AA quick message in the student affairs group chat
   • BA press release issued to local media
   • CA formal written briefing document delivered via secure email, followed by a scheduled conference call
   • DA public post on the university's social media account
   Reveal Solution Discussion Select an answer first