An incident team is using a chat channel for real-time communication, but critical decisions are being lost in the fast-moving conversation. The incident commander needs a way to ensure that key decisions are documented and communicated to the entire team. What is the best practice to implement?

Require all team members to scroll back through the chat log to find decisions.

Use a separate chat channel for each decision topic.

Designate a scribe or note-taker to maintain a running decision log that is posted to a shared document.

Have the incident commander repeat every decision aloud in the chat.

A small organization is establishing an incident management team. They have only five people available to fill all roles. Which team structure is most appropriate for this size?

A full ICS structure with a separate incident commander, operations chief, planning chief, logistics chief, and finance chief.

A flat structure with no designated incident commander, where all decisions are made by majority vote.

A structure where each person has a unique role and no one has more than one responsibility.

A simplified structure where the incident commander also serves as the technical lead, and other members handle operations, communications, and logistics.

GIAC Cyber Incident Leader

Domain 6Objective 1

Incident Management Team Development GCIL Practice Questions (Page 10)

Part of the Team Development and Improvement domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 46–48

46foundation · easy
Which incident management team role is responsible for collecting and preserving evidence in a manner that maintains its chain of custody?
Select an answer first
47application · medium
An incident team is using a chat channel for real-time communication, but critical decisions are being lost in the fast-moving conversation. The incident commander needs a way to ensure that key decisions are documented and communicated to the entire team. What is the best practice to implement?
Select an answer first
48application · medium
A small organization is establishing an incident management team. They have only five people available to fill all roles. Which team structure is most appropriate for this size?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Incident Management Team Development GCIL Practice Questions (Page 10)

Questions 46–48

Which incident management team role is responsible for collecting and preserving evidence in a manner that maintains its chain of custody?

An incident team is using a chat channel for real-time communication, but critical decisions are being lost in the fast-moving conversation. The incident commander needs a way to ensure that key decisions are documented and communicated to the entire team. What is the best practice to implement?

A small organization is establishing an incident management team. They have only five people available to fill all roles. Which team structure is most appropriate for this size?

Keep studying — Team Development and Improvement