Incident Management Team Development GCIL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In Tuckman's model, which stage is characterized by the team working together smoothly, with clear roles and high trust, to achieve common goals?

   • AForming
   • BPerforming
   • CStorming
   • DNorming
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An organization is planning a training exercise to test its incident team's ability to handle a multi-vector attack (e.g., phishing plus DDoS). The team is experienced and has performed well in previous tabletop exercises. The organization wants to challenge the team and identify gaps in their decision-making under stress. Which exercise design would be most effective?

   • AA functional exercise with simulated systems and a 'live' inject that introduces unexpected events and time pressure.
   • BA full-scale simulation that involves all employees and external partners.
   • CA lecture on multi-vector attack response procedures.
   • DA tabletop exercise with a linear scenario that follows a predictable sequence of events.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During an incident, the team must decide whether to pay a ransom to restore encrypted data. The decision involves the CEO, legal counsel, the incident commander, and external law enforcement. Which decision-making process is most appropriate for this high-stakes, multi-stakeholder decision?

   • AThe incident commander makes the decision unilaterally based on technical feasibility.
   • BThe team holds a vote among all incident responders and the CEO.
   • CThe decision is deferred until after the incident is fully contained.
   • DThe team uses a pre-defined escalation path that brings the decision to an executive committee with input from legal and law enforcement.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A large organization is responding to a multi-site malware infection. The incident commander is at the headquarters, and each affected site has its own technical lead. The commander needs to maintain overall coordination while allowing site leads to manage local response. What is the most appropriate team structure?

   • AA centralized structure where the commander makes all decisions and site leads only execute orders.
   • BA flat structure where all site leads report directly to the incident commander.
   • CA hierarchical structure with a central command and site-level coordinators who report to the commander.
   • DA decentralized structure where each site operates independently and shares information only after the incident.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   After a major incident, the incident commander wants to conduct an after-action review (AAR) to capture lessons learned. Several team members are defensive about their performance, and the conversation is becoming unproductive. What is the best approach to ensure the AAR drives improvement?

   • ASkip the AAR and rely on the incident report written by the technical lead.
   • BUse a structured framework like 'what went well, what went wrong, what to improve' and emphasize that the goal is to improve processes, not assign blame.
   • CInvite only the leadership team to the AAR to avoid conflict.
   • DFocus the AAR on identifying individual mistakes and assigning blame to prevent future errors.
   Reveal Solution Discussion Select an answer first