Incident Management Team Development GCIL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company discovers that an attacker has exfiltrated customer data. The incident commander wants to coordinate with law enforcement, but the legal team is concerned about preserving evidence and protecting customer privacy. What is the most appropriate action?

   • ALet the technical team speak directly with law enforcement to avoid legal delays.
   • BContact law enforcement immediately and provide all available details without delay.
   • CWait until the investigation is complete before contacting law enforcement.
   • DHave the legal team establish a communication channel with law enforcement and determine what information can be shared.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key advantage of using a structured decision-making process during an incident?

   • AIt ensures decisions are made by a single leader without input from others
   • BIt guarantees the optimal outcome in every situation
   • CIt reduces the risk of overlooking critical factors and helps maintain consistency
   • DIt eliminates the need for expert input
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which type of exercise involves the actual execution of technical response actions, such as isolating a simulated infected host?

   • AFunctional exercise
   • BFull-scale exercise
   • CTabletop exercise
   • DDrill
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   After an incident, the after-action review reveals that the team made a critical decision based on incomplete information because the communications lead was not included in a key technical briefing. The team wants to prevent this from happening again. What is the most effective improvement to implement?

   • AHave the communications lead shadow the technical lead during incidents.
   • BAdd a checklist item to the incident management plan that requires the communications lead to be invited to all briefings.
   • CCreate a new role of 'briefing coordinator' to manage all meeting invitations.
   • DRequire the communications lead to attend all technical briefings.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a ransomware incident, the incident commander has been coordinating with the legal department, public relations, and external counsel. The technical lead has been managing the containment efforts. A critical decision is needed about whether to pay the ransom. The incident commander is currently unavailable. Who is the most appropriate person to make this decision in the commander's absence?

   • AThe legal counsel, because they can assess the legal and regulatory implications of payment.
   • BThe public relations lead, because they can gauge the reputational impact of paying or not paying.
   • CThe designated deputy incident commander, following the pre-established succession plan.
   • DThe technical lead, because they have the most situational awareness of the technical impact.
   Reveal Solution Discussion Select an answer first