Incident Management Team Development GCIL Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A newly formed incident response team is in its first major exercise. Team members are arguing about the best approach to contain a simulated malware outbreak, and the incident commander is struggling to get the team to agree on a course of action. According to Tuckman's model, which stage is this team in, and what is the most effective leadership action?

   • APerforming; the leader should delegate the decision to the most senior analyst.
   • BNorming; the leader should step back and let the team resolve the conflict on its own.
   • CForming; the leader should provide clear instructions and define each member's role.
   • DStorming; the leader should facilitate a structured decision-making process to resolve conflicts and establish norms.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of establishing a dedicated communication channel for incident response team members?

   • ATo ensure that incident-related information is shared efficiently and securely among team members
   • BTo replace all face-to-face meetings during an incident
   • CTo allow external parties to monitor the team's progress
   • DTo provide a place for social interaction during stressful incidents
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following best describes the typical hierarchy of an incident management team?

   • AA clear chain of command with an Incident Commander at the top and specialized teams below
   • BFlat structure where all members have equal authority and make decisions by consensus
   • CAn informal structure that evolves organically without predefined roles
   • DA single leader who personally performs all technical tasks
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   After a significant incident, the incident commander wants to conduct an after-action review (AAR). Several team members are defensive and worried about being blamed for mistakes. What is the most effective way to conduct the AAR?

   • AIdentify specific individuals who made errors and document them in their personnel files.
   • BFocus only on what went well to keep morale high and avoid conflict.
   • CHave an external consultant interview each team member separately and then present findings to management.
   • DCreate a no-blame environment where the team discusses what happened, why it happened, and what can be improved.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization wants to improve its incident team's ability to handle a cloud-specific incident, such as a misconfigured S3 bucket exposing data. The team has experience with on-premises incidents but lacks cloud expertise. Which training approach would be most effective?

   • AProvide a self-paced online course on cloud security fundamentals.
   • BConduct a tabletop exercise focused on cloud incident scenarios, with a cloud expert available to answer questions.
   • CHave the team read the cloud provider's incident response documentation.
   • DSchedule a full-scale simulation that involves the cloud provider's support team.
   Reveal Solution Discussion Select an answer first