After a significant incident, the incident commander is planning an after-action review. The team is fatigued, and there is pressure from leadership to quickly produce a report. However, the incident revealed deep disagreements about the decision-making process. What is the best approach to balance the need for a timely report with the need for meaningful improvement?

Hold a single, long AAR session immediately to get it done quickly.

Skip the AAR and write the report based on the incident commander's notes.

Have the leadership team conduct the AAR without the rest of the team to save time.

Conduct a brief AAR immediately to capture immediate impressions, then schedule a deeper review after the team has rested.

After a major incident, the after-action review (AAR) identifies that the team lacked a clear decision-making process, leading to delays. The team leader wants to ensure this lesson is incorporated into future training. What is the most effective action?

Update the incident response plan to include a structured decision-making process and incorporate it into the next tabletop exercise.

Hold a team meeting to discuss the AAR findings and then move on.

Document the lesson in the AAR report and file it for future reference.

Replace the incident commander to avoid future decision-making delays.

During a fast-moving incident, the incident commander must decide whether to take down a critical business application to contain a worm. The decision will cause significant financial loss, and the CEO is unavailable. The legal counsel is present and advises that the company may face regulatory penalties if customer data is exfiltrated. What is the most appropriate course of action?

Wait for the CEO to become available before making any decision.

Make the decision to take down the application, documenting the rationale and informing the CEO as soon as possible.

Delegate the decision to legal counsel, as they understand the regulatory implications.

Take a vote among the incident team members to make the decision.

An organization is designing a training exercise to test its incident team's ability to handle a ransomware attack. The team has never worked together in an incident before. Which exercise design would best build team capabilities while also revealing gaps in communication and decision-making?

A full-scale simulation with live malware and real systems to test technical skills.

A functional exercise where each team member works independently on their assigned tasks without interaction.

A tabletop exercise with a scripted scenario and a facilitator who guides the team through the decision points.

A lecture-based training session on ransomware response procedures.

GIAC Cyber Incident Leader

Domain 6Objective 1

Incident Management Team Development GCIL Practice Questions (Page 5)

Part of the Team Development and Improvement domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 21–25

21expert · hard
After a significant incident, the incident commander is planning an after-action review. The team is fatigued, and there is pressure from leadership to quickly produce a report. However, the incident revealed deep disagreements about the decision-making process. What is the best approach to balance the need for a timely report with the need for meaningful improvement?
Select an answer first
22application · medium
After a major incident, the after-action review (AAR) identifies that the team lacked a clear decision-making process, leading to delays. The team leader wants to ensure this lesson is incorporated into future training. What is the most effective action?
Select an answer first
23expert · hard
During a fast-moving incident, the incident commander must decide whether to take down a critical business application to contain a worm. The decision will cause significant financial loss, and the CEO is unavailable. The legal counsel is present and advises that the company may face regulatory penalties if customer data is exfiltrated. What is the most appropriate course of action?
Select an answer first
24application · medium
An organization is designing a training exercise to test its incident team's ability to handle a ransomware attack. The team has never worked together in an incident before. Which exercise design would best build team capabilities while also revealing gaps in communication and decision-making?
Select an answer first
25application · medium
A new incident response team has been formed, and the team leader notices that members are polite but hesitant to share their opinions. They are waiting for the leader to assign tasks and are not taking initiative. According to Tuckman's stages of team development, which stage is this team in?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Incident Management Team Development GCIL Practice Questions (Page 5)

Questions 21–25

After a major incident, the after-action review (AAR) identifies that the team lacked a clear decision-making process, leading to delays. The team leader wants to ensure this lesson is incorporated into future training. What is the most effective action?

An organization is designing a training exercise to test its incident team's ability to handle a ransomware attack. The team has never worked together in an incident before. Which exercise design would best build team capabilities while also revealing gaps in communication and decision-making?

A new incident response team has been formed, and the team leader notices that members are polite but hesitant to share their opinions. They are waiting for the leader to assign tasks and are not taking initiative. According to Tuckman's stages of team development, which stage is this team in?

Keep studying — Team Development and Improvement