Incident Communications GCIL Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary goal of a post-incident communication review?

   • ATo evaluate the effectiveness of communications and identify lessons learned for future incidents
   • BTo delete all records of incident communications
   • CTo create a detailed technical report of the incident for the security team
   • DTo assign blame to individuals who made communication mistakes
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A cloud service provider experiences a data breach affecting multiple customers. The provider must notify affected customers, but the investigation is ongoing and the full scope is unknown. The provider's legal team advises that notification should be made as soon as possible, but not before the scope is understood to avoid under-reporting. Which approach best balances these concerns?

   • ANotify all customers immediately with a generic message, even if the scope is unknown, to comply with 'as soon as possible' requirements.
   • BNotify customers who are likely affected based on preliminary evidence, and provide updates as the investigation continues.
   • CWait until the investigation is complete to provide a comprehensive notification to all affected customers.
   • DNotify only the customers who have contractual clauses requiring immediate notification, and ignore others until the investigation is complete.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security analyst needs to explain a phishing incident to the HR director, who is not technical. Which explanation is MOST appropriate?

   • AThe email gateway failed to detect a spear-phishing payload due to a missing SPF/DKIM alignment, allowing a credential-harvesting page to capture authentication tokens.
   • BAn attacker sent emails that tricked some employees into entering their passwords on a fake login page; we have reset those passwords and are monitoring for unusual activity.
   • CWe are investigating a potential security incident; no further details are available.
   • DSome employees clicked on a bad link, but it's not a big deal.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A regional bank is updating its incident communication plan. The plan must ensure that during a core-banking outage, the board of directors receives a high-level impact summary within 30 minutes, the IT operations team receives technical details immediately, and the state banking regulator is notified within the legally required 4-hour window. Which approach best satisfies these requirements?

   • ADefine stakeholder-specific channels and timing: page IT operations immediately, send an executive summary to the board within 30 minutes, and trigger the regulatory notification process at the 4-hour mark.
   • BCreate a single communication plan that uses email for all stakeholders, with a standard template containing both technical and executive summaries.
   • CUse a single conference bridge for all stakeholders, and provide a verbal update that covers both technical and business impact details.
   • DSend the same email to all stakeholders every 30 minutes, with the full technical details included, to ensure no one is left out.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company operating in the EU and the US experiences a breach that affects personal data of EU residents and US customers. The incident commander must determine notification obligations. Which approach is MOST appropriate?

   • ANotify the relevant EU supervisory authority within 72 hours and comply with US state breach notification laws as applicable
   • BNotify only the US authorities because the company is headquartered in the US
   • CNotify no one until legal counsel determines the exact legal requirements
   • DNotify only the EU supervisory authority because the breach affects EU residents
   Reveal Solution Discussion Select an answer first