After a data breach, the incident leader wants to document lessons learned for a broad audience, including non-technical stakeholders. Which documentation approach is most effective?

Present the lessons in a meeting but do not create any written documentation

Write a 50-page technical report with all forensic details

Create a one-page summary with key takeaways and links to detailed technical reports

Share lessons only in a private chat group for the incident team

What is the purpose of using KPIs in incident management?

To increase the number of incidents reported

To replace the need for post-incident reviews

To assign individual performance ratings

To measure the effectiveness of incident response and identify areas for improvement

Which activity is a core component of a structured post-incident review?

Assigning disciplinary action to the incident responder

Identifying what went well, what went wrong, and what can be improved

Deleting all incident logs to protect sensitive information

Immediately implementing a fix without analysis

A review of a phishing incident found that the incident response plan did not specify how to handle credential theft. What should the incident leader do?

Update the incident response plan to include credential theft procedures and train the team on them

Keep the plan unchanged to maintain consistency

Wait until the next credential theft incident to update the plan

Delete the plan and create a new one from scratch

GIAC Cyber Incident Leader

Domain 6Objective 2

Incident Management Improvement GCIL Practice Questions (Page 3)

Part of the Team Development and Improvement domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 11–15

11foundation · easy
Which technique is commonly used for root cause analysis?
Select an answer first
12application · medium
After a data breach, the incident leader wants to document lessons learned for a broad audience, including non-technical stakeholders. Which documentation approach is most effective?
Select an answer first
13foundation · easy
What is the purpose of using KPIs in incident management?
Select an answer first
14foundation · easy
Which activity is a core component of a structured post-incident review?
Select an answer first
15application · easy
A review of a phishing incident found that the incident response plan did not specify how to handle credential theft. What should the incident leader do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.