Incident Management Improvement GCIL Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   After a ransomware incident, the post-incident review identified that the initial access occurred via a phishing email that bypassed the email gateway. The team is now discussing the root cause. The CISO asks you to ensure the review focuses on systemic issues rather than individual blame. Which approach best aligns with this directive?

   • AImmediately implement a new email filtering solution and close the review without further analysis.
   • BConduct a 5 Whys analysis starting with 'Why did the email bypass the gateway?' to trace the process and technology gaps.
   • CDocument the incident as 'human error' and move on to the next action item.
   • DIdentify the employee who clicked the link and recommend disciplinary action to deter future mistakes.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After a significant incident, your team has drafted a set of improvement initiatives. Before finalizing, you want to ensure that stakeholders, including IT operations and legal, support the changes. What is the most effective way to incorporate their feedback?

   • ASend the draft initiatives via email and ask for comments within 24 hours.
   • BHold a feedback session with stakeholders to present the initiatives and collect their input before finalizing.
   • COnly share the initiatives with the security team to avoid delays.
   • DFinalize the initiatives and inform stakeholders after implementation.
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   A post-incident review shows that the team took too long to contain a malware outbreak because they were unfamiliar with the endpoint detection and response (EDR) tool. What is the most direct way to address this skill gap?

   • AProvide hands-on training sessions on the EDR tool and create quick-reference guides
   • BAssign a senior analyst to handle all EDR-related tasks
   • CReplace the EDR tool with a different product
   • DIncrease the number of alerts monitored by the team
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   During a post-incident review, the team is discussing a service outage. The facilitator wants to ensure the review identifies underlying causes rather than just symptoms. Which technique is most appropriate?

   • AAsk 'what happened' and then 'why did that happen' repeatedly until reaching a systemic cause
   • BFocus on who was responsible for the outage
   • CDocument the timeline and stop once the immediate trigger is found
   • DList all possible causes and vote on the most likely one
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   Your team just completed a major incident review and identified several lessons learned. You need to share these with the broader organization to prevent similar incidents. Which documentation approach is most effective?

   • AVerbally mention the lessons learned in the next team meeting and take no further action.
   • BKeep the lessons learned confidential within the incident response team to avoid reputational risk.
   • CSend a detailed technical report with all system logs and forensic evidence to all employees.
   • DPublish a concise, anonymized summary of the incident, key findings, and recommended actions on the internal knowledge base.
   Reveal Solution Discussion Select an answer first