Incident Management Team Development GCIL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In an incident management team, which role is primarily responsible for making final decisions about containment and eradication strategies during a major security incident?

   • AScribe
   • BPublic Relations Lead
   • CSubject Matter Expert
   • DIncident Commander
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of conducting tabletop exercises for an incident management team?

   • ATo evaluate the performance of individual team members for annual reviews
   • BTo replace all other forms of training
   • CTo test the physical security of the incident command center
   • DTo test the team's ability to respond to a simulated incident in a low-stress, discussion-based environment
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During a ransomware incident, the incident commander must decide whether to restore from backups or pay the ransom. The backups are believed to be intact but have not been fully tested. The legal team advises that paying the ransom may violate sanctions. What is the most appropriate decision-making approach?

   • ADecide to restore from backups immediately, ignoring the legal concerns about paying.
   • BGather input from the technical team on backup integrity and from legal on sanctions, then make a decision based on the combined information.
   • CDecide to pay the ransom immediately to minimize downtime, since the backups are untested.
   • DDelay the decision until the backups are fully tested and the legal review is complete.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a key characteristic of an effective communication protocol for incident management teams?

   • AAll communication is conducted through informal channels to speed up information flow
   • BPredefined channels and formats for different message types, such as alerts, updates, and escalations
   • CUse of a single communication channel for all types of messages
   • DCommunication is limited to the incident commander to avoid overwhelming the team
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an incident, the technical team discovers a critical finding that requires immediate action. The incident commander is in a meeting with executives and cannot be reached. The technical lead has the authority to contain the threat but is unsure whether to act without the commander's approval. What is the most appropriate action?

   • ADocument the finding and continue monitoring until the commander returns.
   • BEscalate the finding to the executive team for a decision.
   • CWait until the incident commander is available to avoid overstepping authority.
   • DProceed with containment actions that are within the technical lead's pre-authorized scope and inform the commander as soon as possible.
   Reveal Solution Discussion Select an answer first