What is the first step in designing a training program to improve incident handling capabilities?

Evaluate training effectiveness

After implementing improvements from a post-incident review, the incident leader wants to gather feedback from stakeholders. Which method is most effective for incorporating feedback into future improvements?

Conduct a structured feedback session with key stakeholders and document the input

Wait for stakeholders to volunteer feedback

Rely on informal conversations with a few team members

Send a survey but do not share the results

After a phishing incident, the team wants to document lessons learned so that other teams can benefit. Which format is most effective for knowledge sharing?

A concise, searchable document with clear headings, key takeaways, and links to updated procedures

A detailed technical report stored in a shared drive with limited access

A verbal summary presented once at a team meeting

An email sent only to the incident response team

What is the primary purpose of incident management improvement?

To assign blame for incidents and ensure accountability

To document incidents for legal compliance only

To increase the frequency of incidents to practice response

To enhance team performance and organizational resilience through systematic learning and process refinement

After a major incident, the review produced 15 action items. The team has limited capacity and the CISO wants to ensure the most critical items are completed within 30 days. Which approach best balances prioritization and feasibility?

Categorize action items by urgency and impact, assign owners, and set realistic due dates based on team capacity.

Assign all 15 action items to the team with a 30-day deadline and let them manage their own priorities.

Delay all action items until the next quarter when the team has more capacity.

Focus only on the action items that are easiest to complete to build momentum.

GIAC Cyber Incident Leader

Domain 6Objective 2

Incident Management Improvement GCIL Practice Questions (Page 2)

Part of the Team Development and Improvement domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 6–10

6foundation · easy
What is the first step in designing a training program to improve incident handling capabilities?
Select an answer first
7application · medium
After implementing improvements from a post-incident review, the incident leader wants to gather feedback from stakeholders. Which method is most effective for incorporating feedback into future improvements?
Select an answer first
8application · medium
After a phishing incident, the team wants to document lessons learned so that other teams can benefit. Which format is most effective for knowledge sharing?
Select an answer first
9foundation · easy
What is the primary purpose of incident management improvement?
Select an answer first
10expert · hard
After a major incident, the review produced 15 action items. The team has limited capacity and the CISO wants to ensure the most critical items are completed within 30 days. Which approach best balances prioritization and feasibility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.