A global company is responding to a data breach that affects customers in multiple time zones. The incident commander must provide updates to customers, employees, and executives. Which communication strategy BEST balances the need for timely updates with the need for accuracy?

Provide immediate, brief updates to all stakeholders with the known facts, and follow up with more detailed information as the investigation progresses

Communicate only with executives and let them decide what to share with others

Wait until the investigation is complete before communicating to avoid any inaccuracies

Send a single, detailed update to all stakeholders at the same time to ensure consistency

Which group is typically considered an external stakeholder for incident communication?

The incident response team members

A data breach at a law firm exposes client confidential information. The firm must notify affected clients, the state bar association, and potentially law enforcement. Which stakeholder should be prioritized for immediate notification?

Law enforcement, to begin a criminal investigation

Affected clients, to allow them to protect themselves from identity theft

The state bar association, because it regulates the firm's conduct

The firm's legal counsel and insurance carrier, to assess legal obligations and coverage

During a ransomware incident, the incident commander must brief the CEO. The CEO needs to decide whether to pay the ransom. Which statement BEST supports the CEO's decision-making?

We are working on it and will update you when we know more.

The ransomware variant is Sodinokibi and it uses a hybrid encryption scheme; we have identified the C2 server IP addresses.

The FBI recommends not paying ransoms, so we should not pay.

The attack has halted order processing, potentially costing $500,000 per day; we have backups that may restore systems in 48 hours, but paying the ransom could restore access faster, though it is illegal in some jurisdictions.

A manufacturing company is experiencing a cyber incident that has halted production. The incident commander must provide updates to three groups: the plant floor supervisors, the executive team, and the company's external cybersecurity insurance provider. Which communication channel and format combination is MOST appropriate for the executive team?

A detailed technical timeline posted on the internal IT wiki

A public press release issued immediately

A real-time chat channel with raw sensor logs and packet captures

A concise email with a bullet-point summary of business impact, current status, and required decisions

GIAC Cyber Incident Leader

Domain 5Objective 1

Incident Communications GCIL Practice Questions (Page 6)

Part of the Communication and Reporting domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 26–30

26expert · hard
A global company is responding to a data breach that affects customers in multiple time zones. The incident commander must provide updates to customers, employees, and executives. Which communication strategy BEST balances the need for timely updates with the need for accuracy?
Select an answer first
27foundation · easy
Which group is typically considered an external stakeholder for incident communication?
Select an answer first
28application · medium
A data breach at a law firm exposes client confidential information. The firm must notify affected clients, the state bar association, and potentially law enforcement. Which stakeholder should be prioritized for immediate notification?
Select an answer first
29application · medium
During a ransomware incident, the incident commander must brief the CEO. The CEO needs to decide whether to pay the ransom. Which statement BEST supports the CEO's decision-making?
Select an answer first
30application · medium
A manufacturing company is experiencing a cyber incident that has halted production. The incident commander must provide updates to three groups: the plant floor supervisors, the executive team, and the company's external cybersecurity insurance provider. Which communication channel and format combination is MOST appropriate for the executive team?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.