Incident Management Team Development GCIL Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An incident response team has been together for over a year and has handled several incidents successfully. However, after a recent incident, the after-action review revealed that the team had become complacent and missed critical indicators. The team leader wants to reinvigorate the team and prevent future complacency. What is the most effective approach?

   • AReassign team members to different roles to disrupt established patterns.
   • BBring in an external consultant to review the team's processes and provide recommendations.
   • CConduct a challenging red-team exercise that introduces novel attack techniques the team has not seen before.
   • DIncrease the frequency of routine tabletop exercises using familiar scenarios.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An organization is coordinating with law enforcement and a third-party incident response firm during a ransomware investigation. The law enforcement agency requests that the organization not share certain evidence with the third-party firm, citing an ongoing criminal investigation. The third-party firm needs that evidence to complete its analysis. What is the best way to handle this conflict?

   • ARefuse to share the evidence with the third-party firm and end the engagement.
   • BShare the evidence with the third-party firm anyway, as they are under a confidentiality agreement.
   • CFacilitate a meeting between law enforcement and the third-party firm to discuss the evidence handling and reach an agreement.
   • DAsk the third-party firm to sign a non-disclosure agreement with law enforcement.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During a major incident, the incident commander needs to provide a status update to executives and also coordinate with the technical team. The technical team is using a secure chat channel, while executives expect a formal written briefing. What is the most effective communication approach?

   • AAssign a liaison to provide tailored updates to executives while the technical team continues using the chat channel.
   • BUse the same chat channel for both groups to ensure everyone has the same information in real time.
   • CLimit communication to the incident commander to avoid overwhelming the team with too many messages.
   • DHave the incident commander post updates in the chat channel and also send a formal email to executives.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which structured decision-making process is commonly used in high-pressure incident situations to quickly assess options and select the best course of action?

   • ADelphi method
   • BOODA loop
   • CCost-benefit analysis
   • DSix Thinking Hats
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During a data breach investigation, the incident commander needs to coordinate with law enforcement, an external forensics vendor, and the organization's public relations firm. The team is struggling with conflicting requests for information and evidence. What is the most effective way to manage these external relationships?

   • ADesignate a single liaison for each external entity and establish a secure information-sharing protocol.
   • BAllow each external entity to communicate directly with any team member to speed up information sharing.
   • CProvide all external entities with full access to the incident chat channel.
   • DHave the incident commander personally handle all external communications.
   Reveal Solution Discussion Select an answer first