Incident Management Improvement GCIL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a post-incident review, you notice that the team struggled with analyzing memory forensics, causing delays in containment. The team has no formal training in this area. What should you do to address this skill gap?

   • APurchase a commercial memory forensics tool and assume it will compensate for the skill gap.
   • BRemove memory forensics from the incident response process to avoid the issue.
   • CAssign the memory forensics tasks to a single team member who has some experience.
   • DDesign a targeted training program on memory forensics and schedule it before the next incident.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why should incident management procedures be updated after a review?

   • ATo incorporate lessons learned and address changing threats
   • BTo change the incident response team's leadership
   • CTo keep the procedures document lengthy
   • DTo satisfy auditor requirements only
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which continuous improvement framework involves the cycle of Plan, Do, Check, Act?

   • AScrum
   • BWaterfall
   • CPDCA
   • DITIL
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary focus of Lean methodology in incident management improvement?

   • AEliminating waste and optimizing process flow
   • BImplementing more security tools
   • CIncreasing the number of incident responders
   • DAssigning blame for process failures
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   Your team is conducting a post-incident review for a ransomware attack. The review is taking longer than expected because the team is debating whether the root cause was a phishing email or a delayed patch. The CISO wants the review to conclude with actionable improvements. What should you do to keep the review productive?

   • AUse a fishbone diagram to map all contributing factors and then prioritize action items based on impact.
   • BFocus only on the phishing email because it was the initial attack vector.
   • CDecide the root cause yourself and end the discussion.
   • DLet the team continue debating until they agree on a single root cause.
   Reveal Solution Discussion Select an answer first