A small business is creating an incident communication plan. They have limited resources and need to prioritize stakeholders. Which stakeholder group should be assigned the HIGHEST priority for immediate notification during a cyber incident?

All employees via a company-wide email

Which situation would most likely trigger an escalation to senior management?

A routine security scan that finds no issues

A minor phishing email that was blocked by the email filter

A low-severity incident that is contained within a single department

The incident has the potential to cause significant financial loss or regulatory penalties

After a phishing incident, the incident commander wants to improve future incident communications. Which action is MOST aligned with a post-incident communication review?

Conduct a survey of stakeholders to gather feedback on the clarity and timeliness of updates

Create a new communication plan from scratch without referencing the old one

Focus only on the technical root cause and ignore communication issues

Archive all communication logs and never review them

When communicating with executives about an incident, what is the most important focus?

The names of all systems affected

The personal opinions of the security team

The technical details of the attack vector

Business impact, risks, and decisions required from them

A regional hospital is responding to a ransomware attack that has encrypted patient records and disrupted the electronic health record system. The incident commander needs to establish a communication plan. Which stakeholder group should receive the FIRST formal notification, before any public statement is made?

The hospital's executive leadership and board of directors

The state health information exchange partners

Patients whose records may have been accessed

GIAC Cyber Incident Leader

Domain 5Objective 1

Incident Communications GCIL Practice Questions (Page 8)

Part of the Communication and Reporting domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 36–40

36application · medium
A small business is creating an incident communication plan. They have limited resources and need to prioritize stakeholders. Which stakeholder group should be assigned the HIGHEST priority for immediate notification during a cyber incident?
Select an answer first
37foundation · easy
Which situation would most likely trigger an escalation to senior management?
Select an answer first
38application · medium
After a phishing incident, the incident commander wants to improve future incident communications. Which action is MOST aligned with a post-incident communication review?
Select an answer first
39foundation · easy
When communicating with executives about an incident, what is the most important focus?
Select an answer first
40application · medium
A regional hospital is responding to a ransomware attack that has encrypted patient records and disrupted the electronic health record system. The incident commander needs to establish a communication plan. Which stakeholder group should receive the FIRST formal notification, before any public statement is made?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.