What is a playbook in the context of incident management?

A list of all employees' contact information

A tool for automating all incident response

A predefined set of steps to handle a specific type of incident

A security team wants to improve its incident response. They have limited resources and need to choose KPIs that will drive meaningful improvement. They are considering MTTD, MTTR, and the number of incidents reopened. Which KPI should they prioritize if their main problem is that incidents are not being fully resolved the first time?

Number of security tools deployed

After a major incident, the security team has proposed several changes to the incident response process. The changes are technically sound, but the IT operations team is resistant because they feel the changes will increase their workload. How should you address this to gain their support?

Engage IT operations in a feedback session to understand their concerns and adjust the changes to minimize additional workload.

Abandon the changes to avoid conflict with IT operations.

Escalate the issue to senior management to mandate the changes.

Implement the changes and explain the benefits after they are in place.

A post-incident review produced 15 action items. The incident leader must ensure they are completed. Which approach is most effective for tracking and closing action items?

Close all action items immediately if the team agrees they are no longer relevant.

Add all action items to the team's backlog and let the team prioritize them during the next sprint planning.

Assign each action item an owner, priority, and due date, then review progress at weekly meetings until closure.

Email the list to all team members and ask them to report completion by the end of the month.

An incident leader wants to systematically improve the incident management process using a continuous improvement framework. Which approach best aligns with the PDCA cycle?

Implement a change immediately and only review it if another incident occurs

Plan a change, implement it, measure the results, and standardize if successful

Set annual improvement goals and review them at the end of the year

Analyze past incidents, but do not implement changes until the next major incident

GIAC Cyber Incident Leader

Domain 6Objective 2

Incident Management Improvement GCIL Practice Questions (Page 4)

Part of the Team Development and Improvement domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 16–20

16foundation · easy
What is a playbook in the context of incident management?
Select an answer first
17expert · hard
A security team wants to improve its incident response. They have limited resources and need to choose KPIs that will drive meaningful improvement. They are considering MTTD, MTTR, and the number of incidents reopened. Which KPI should they prioritize if their main problem is that incidents are not being fully resolved the first time?
Select an answer first
18expert · hard
After a major incident, the security team has proposed several changes to the incident response process. The changes are technically sound, but the IT operations team is resistant because they feel the changes will increase their workload. How should you address this to gain their support?
Select an answer first
19application · medium
A post-incident review produced 15 action items. The incident leader must ensure they are completed. Which approach is most effective for tracking and closing action items?
Select an answer first
20application · medium
An incident leader wants to systematically improve the incident management process using a continuous improvement framework. Which approach best aligns with the PDCA cycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.