Incident Management Improvement GCIL Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   Your organization has a strict policy that incident details must be kept confidential. However, the post-incident review identified lessons that could benefit other teams. You need to share the lessons without violating confidentiality. What is the best approach?

   • ACreate an anonymized lessons-learned document that removes sensitive details and shares it with relevant teams.
   • BDo not share any lessons learned to comply with the confidentiality policy.
   • CShare the lessons learned verbally in a meeting without documentation.
   • DShare the full incident report with all teams to ensure transparency.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which characteristic makes lessons learned documentation effective?

   • AKept confidential from the team
   • BWritten in technical jargon only
   • CStored in a single expert's memory
   • DClear and accessible format
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   After implementing changes from a post-incident review, the incident leader wants to ensure stakeholders are aware and supportive. Which action is most effective for stakeholder communication and feedback?

   • AWait for the next annual report to mention the changes
   • BDo not communicate the changes to avoid raising concerns
   • CSend a one-time email to executives only
   • DPublish a summary of the changes on the internal security portal and invite comments
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A post-incident review of a data breach identified multiple contributing factors: an unpatched vulnerability, a delayed detection alert, and a lack of a communication plan. The team is debating which factor to address first. The CISO wants to prioritize actions that will have the greatest impact on preventing recurrence. Which approach should you take?

   • AImplement the communication plan first because it is quickest to complete.
   • BAddress the unpatched vulnerability first because it is the most technical and visible issue.
   • CUse a fishbone diagram to categorize the factors and then prioritize action items based on their potential to prevent recurrence.
   • DCreate action items for all factors and let the team decide which to work on first.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which element is essential for effective action item closure?

   • AA budget allocation for every action item
   • BA defined owner and due date
   • CApproval from all team members
   • DA public announcement of the action item
   Reveal Solution Discussion Select an answer first