A mid-sized e-commerce company is developing an incident communication plan. They have identified stakeholders: customers, employees, executives, and the payment card processor. Which communication plan element is MOST critical to include for the payment card processor?

A scheduled weekly newsletter about general security improvements

A public press release template for customers

A social media policy for employees

A specific contact person and escalation path for breach notification, with a defined timeline

A company's e-commerce site is down due to a web application firewall (WAF) misconfiguration during a routine update. The incident commander must brief the Chief Marketing Officer (CMO). Which statement best communicates the situation in a business-focused manner?

The website is down, but we are handling it. No action is needed from you.

Our website is currently unavailable, which may impact online sales. We are working to restore service and expect it to be back within 30 minutes.

The WAF rule set was incorrectly applied, blocking legitimate traffic. We are rolling back the configuration.

We are having technical issues with our website. We will update you when it is fixed.

Which communication channel is most appropriate for providing real-time updates to the incident response team during an active incident?

A printed memo distributed to team members

A formal email distribution list

A voicemail broadcast to all team members

A dedicated incident chat channel (e.g., Slack or Teams)

During a ransomware incident, the incident commander must provide a status update to the board of directors. The board is concerned about the financial impact and regulatory implications. Which update best addresses these concerns?

We have identified the ransomware strain as Ryuk and are working with law enforcement. The technical team is isolating affected systems and restoring from backups.

We are handling the incident and will provide an update when it is resolved.

The ransomware has affected our operations, and we are assessing the financial impact. We are working with legal counsel to determine regulatory notification requirements and will provide an update within 24 hours.

The ransomware is contained, and we expect to resume operations soon. No regulatory notification is needed.

Why is it important for an incident responder to be aware of legal and regulatory notification requirements?

To ensure that all incident details are shared publicly as soon as possible

To ensure the organization meets its obligations and avoids penalties for late or missed notifications

To ensure that no communication is sent without the approval of the legal department

To ensure that the incident is kept confidential from all external parties

GIAC Cyber Incident Leader

Domain 5Objective 1

Incident Communications GCIL Practice Questions (Page 4)

Part of the Communication and Reporting domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 16–20

16application · medium
A mid-sized e-commerce company is developing an incident communication plan. They have identified stakeholders: customers, employees, executives, and the payment card processor. Which communication plan element is MOST critical to include for the payment card processor?
Select an answer first
17application · medium
A company's e-commerce site is down due to a web application firewall (WAF) misconfiguration during a routine update. The incident commander must brief the Chief Marketing Officer (CMO). Which statement best communicates the situation in a business-focused manner?
Select an answer first
18foundation · easy
Which communication channel is most appropriate for providing real-time updates to the incident response team during an active incident?
Select an answer first
19expert · hard
During a ransomware incident, the incident commander must provide a status update to the board of directors. The board is concerned about the financial impact and regulatory implications. Which update best addresses these concerns?
Select an answer first
20foundation · easy
Why is it important for an incident responder to be aware of legal and regulatory notification requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.