Incident Communications GCIL Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which statement best describes how to present incident information to executives?

   • AUse as much technical jargon as possible to demonstrate expertise
   • BAvoid mentioning risks to prevent panic
   • CProvide a detailed timeline of every action taken by the security team
   • DTranslate technical details into business terms, such as revenue impact, customer impact, and legal exposure
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of defining update timing in an incident communication plan?

   • ATo satisfy the personal preferences of the incident commander
   • BTo ensure stakeholders receive information at predictable intervals and can plan their actions accordingly
   • CTo ensure that all updates are sent only after the incident is fully resolved
   • DTo minimize the number of updates sent during an incident
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A hospital experiences a ransomware attack that disrupts electronic health records (EHR) access. The incident commander must balance the need to notify the Department of Health and Human Services (HHS) under HIPAA Breach Notification Rule (within 60 days) and the need to inform the public if there is a risk to patient safety. The attack is confirmed, but the investigation is ongoing. What is the best course of action?

   • ANotify HHS immediately with all details, and do not issue a public statement until HHS approves it.
   • BWait until the investigation is complete to determine if patient data was accessed, then notify HHS and the public if required.
   • CImmediately issue a public statement warning patients to seek alternative care, even before the HHS notification is prepared.
   • DNotify HHS within the 60-day window with available information, and issue a public statement only if there is an immediate risk to patient safety, coordinating with legal counsel.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst needs to send a status update to the executive team about a distributed denial-of-service (DDoS) attack. Which update best conveys the situation, impact, and next steps in a business-focused manner?

   • AOur customer-facing website is intermittently unavailable, which may affect sales. We are working with our provider to reroute traffic and expect restoration within 2 hours.
   • BOur network team is handling the issue. No action is needed from you at this time.
   • CThe attack is ongoing and we are monitoring. We will provide an update when we have more information.
   • DWe are experiencing a volumetric DDoS attack on our edge routers, with SYN flood and UDP amplification. The mitigation team is tuning rate limits and scrubbing filters.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A manufacturing company's OT network is infected with malware, causing production line stoppages. The incident commander must brief the CEO. Which statement best communicates the situation in a business-focused manner?

   • AProduction is halted due to a cyber incident, which may delay customer orders. We are working to restore systems and need your decision on whether to pay overtime for the night shift.
   • BOur OT network is down, but we are handling it. We will update you when it is fixed.
   • CThe malware is contained, and we expect to resume production soon. No action is needed from you.
   • DWe have a malware infection on our OT network, specifically a worm that is spreading through SMB vulnerabilities. We are isolating segments and patching.
   Reveal Solution Discussion Select an answer first