Your team has been using the same incident response process for two years. Incident metrics show that mean time to contain (MTTC) has plateaued, and the team is resistant to change. You want to apply a continuous improvement methodology to break the plateau. Which approach is most effective?

Mandate a new containment process immediately and require the team to follow it.

Use PDCA to test a revised containment process on a pilot basis, measure the impact on MTTC, and then decide whether to adopt it.

Benchmark against other teams and adopt their process without testing.

Set a higher MTTC target and expect the team to meet it with the current process.

After a ransomware incident, the incident commander schedules a post-incident review. The team has 90 minutes, and the facilitator wants to ensure the review produces actionable outcomes. Which approach best aligns with the purpose of a structured post-incident review?

Ask each participant to submit written feedback privately, then archive the feedback without further discussion.

Focus on identifying which team members made mistakes so accountability can be assigned.

Limit the discussion to technical root causes only, avoiding process or communication issues to keep the meeting short.

Document the timeline, discuss what went well and what went wrong, and generate prioritized action items with owners and due dates.

What is the purpose of tracking action items from incident reviews?

To document the incident for legal purposes

To increase the number of open tasks

To assign blame for the incident

To ensure that identified improvements are implemented and closed

A post-incident review reveals that the team struggled with cloud forensics. The incident leader wants to address this skill gap. Which action is most directly aligned with training and skill development?

Enroll the team in a cloud forensics certification course and schedule hands-on labs

Purchase additional cloud monitoring tools

Create a new playbook for cloud incident response

Hire a consultant to handle all future cloud incidents

Which metric is commonly used to measure incident response effectiveness?

Size of the incident response budget

Number of security tools deployed

GIAC Cyber Incident Leader

Domain 6Objective 2

Incident Management Improvement GCIL Practice Questions (Page 10)

Part of the Team Development and Improvement domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 46–50

46expert · hard
Your team has been using the same incident response process for two years. Incident metrics show that mean time to contain (MTTC) has plateaued, and the team is resistant to change. You want to apply a continuous improvement methodology to break the plateau. Which approach is most effective?
Select an answer first
47application · medium
After a ransomware incident, the incident commander schedules a post-incident review. The team has 90 minutes, and the facilitator wants to ensure the review produces actionable outcomes. Which approach best aligns with the purpose of a structured post-incident review?
Select an answer first
48foundation · easy
What is the purpose of tracking action items from incident reviews?
Select an answer first
49application · easy
A post-incident review reveals that the team struggled with cloud forensics. The incident leader wants to address this skill gap. Which action is most directly aligned with training and skill development?
Select an answer first
50foundation · easy
Which metric is commonly used to measure incident response effectiveness?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.