A major incident occurred due to a misconfigured firewall. The post-incident review team is divided: some want to use 5 Whys, others prefer a fishbone diagram. The incident leader wants to identify the most likely root cause and generate action items. Which approach is most appropriate?

Skip root cause analysis and focus only on immediate containment

Use both techniques simultaneously in the same session

Use a fishbone diagram to explore multiple categories, then prioritize causes

Use 5 Whys to drill down to a single root cause, then create action items

Your incident response team has been tracking MTTR and MTTC for the past year. The metrics show improvement, but the CISO is concerned that the team may be sacrificing thoroughness for speed. You need to add a metric that balances speed with quality. Which metric would you recommend?

Number of tools used during incident response.

Number of incidents handled per analyst per month.

Percentage of incidents where the root cause was correctly identified within the review.

Total time spent on post-incident reviews.

After a series of phishing incidents, your team notices that the same root cause keeps appearing: users are not reporting suspicious emails quickly. You want to systematically improve this process. Which approach best applies the PDCA cycle?

Wait for the next incident to see if the problem recurs before making any changes.

Immediately implement a new reporting tool and assume it will solve the problem.

Plan a new reporting workflow, Do a pilot, Check the results, Act by rolling it out or adjusting.

Conduct a one-time training session and consider the problem solved.

A review of a malware outbreak found that the existing playbook did not include steps for isolating infected endpoints. What should the incident leader do to update the process?

Keep the playbook unchanged to avoid confusion during incidents

Only update the playbook if the same malware appears again

Delete the playbook and rely on ad-hoc decision-making

Revise the playbook to include isolation steps and communicate the change to all responders

Your security team wants to measure the effectiveness of its incident response process. The team currently tracks the number of incidents handled per month. The CISO asks for a metric that better reflects the quality of the response. Which metric would you recommend adding?

Total number of security alerts generated per month

Percentage of employees who completed security awareness training

Number of security tools deployed in the environment

Mean time to respond (MTTR) and mean time to contain (MTTC)

GIAC Cyber Incident Leader

Domain 6Objective 2

Incident Management Improvement GCIL Practice Questions (Page 7)

Part of the Team Development and Improvement domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 31–35

31expert · hard
A major incident occurred due to a misconfigured firewall. The post-incident review team is divided: some want to use 5 Whys, others prefer a fishbone diagram. The incident leader wants to identify the most likely root cause and generate action items. Which approach is most appropriate?
Select an answer first
32expert · hard
Your incident response team has been tracking MTTR and MTTC for the past year. The metrics show improvement, but the CISO is concerned that the team may be sacrificing thoroughness for speed. You need to add a metric that balances speed with quality. Which metric would you recommend?
Select an answer first
33application · medium
After a series of phishing incidents, your team notices that the same root cause keeps appearing: users are not reporting suspicious emails quickly. You want to systematically improve this process. Which approach best applies the PDCA cycle?
Select an answer first
34application · easy
A review of a malware outbreak found that the existing playbook did not include steps for isolating infected endpoints. What should the incident leader do to update the process?
Select an answer first
35application · medium
Your security team wants to measure the effectiveness of its incident response process. The team currently tracks the number of incidents handled per month. The CISO asks for a metric that better reflects the quality of the response. Which metric would you recommend adding?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.