Incident Management Team Development GCIL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary goal of an after-action review (AAR) following an incident?

   • ATo assign blame for failures that occurred during the incident
   • BTo celebrate the team's successes without discussing failures
   • CTo document the incident for legal purposes only
   • DTo identify what happened, why it happened, and how to improve future response
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is coordinating with law enforcement during a cyber incident. The incident commander wants to share technical indicators of compromise (IOCs) with law enforcement while protecting the company's legal interests. What is the most appropriate way to share this information?

   • AShare IOCs directly in the incident chat channel to ensure law enforcement has real-time access.
   • BVerbally share IOCs over a phone call to avoid creating a written record.
   • CWait until the incident is fully contained before sharing any IOCs.
   • DProvide IOCs through a secure, documented channel such as an encrypted email or a law enforcement portal, with legal counsel's approval.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   During a prolonged incident, the incident commander is receiving conflicting reports from the technical lead and the communications lead about the status of containment. The technical lead says the threat is contained, while the communications lead is preparing a public statement that the threat is still active. What is the most likely cause of this conflict, and what is the best immediate action?

   • AThe technical lead is not sharing enough detail; the IC should demand a full technical report.
   • BThe team lacks a single source of truth for incident status; the IC should establish a shared status board and require all leads to update it.
   • CThe communications lead is not involved in technical briefings; the IC should include them in the next technical update.
   • DThe IC should make a decision based on the technical lead's report and instruct the communications lead to change the statement.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During a multi-day incident, the incident commander notices that critical updates from the network security team are being posted only in a chat channel that the executive leadership does not monitor. Meanwhile, the legal team is sending emails to the IC that are not being read promptly. Which communication protocol change would most improve situational awareness for all stakeholders?

   • ARequire all team members to monitor the chat channel and respond within five minutes.
   • BEstablish a single, authoritative communication channel for all incident updates, such as a dedicated email distribution list.
   • CDefine a communication matrix that specifies which channels are used for different types of information and audiences.
   • DHave the incident commander personally call each stakeholder with every update.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A newly formed incident team has completed its first tabletop exercise. The team is now in the norming stage, but the incident commander notices that some members are still hesitant to challenge the ideas of a senior member. What is the most effective way to encourage constructive dissent and move the team toward performing?

   • AImplement a 'red team' approach during exercises where a designated member is tasked with challenging assumptions and decisions.
   • BEncourage the hesitant members to voice their concerns only in private to the incident commander.
   • CAssign the senior member as the sole decision-maker to avoid conflict.
   • DProvide additional training on the technical aspects of incident response.
   Reveal Solution Discussion Select an answer first