Incident Management Team Development GCIL Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   During a major incident, the incident commander is also acting as the technical lead because the organization is small. The IC is becoming overwhelmed, and the team is missing critical updates. The organization cannot hire additional staff immediately. What is the best way to address this situation?

   • AHave the IC stop attending technical briefings and rely on written reports.
   • BDelegate the technical lead responsibilities to a senior analyst and have the IC focus on command and coordination.
   • CBring in an external consultant to act as the technical lead.
   • DKeep the current structure and have the IC work longer hours to manage both roles.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   During a large-scale incident, the incident commander is overwhelmed with requests from multiple business units, each demanding priority for their systems. The commander is spending so much time on communication that strategic decisions are being delayed. What is the most effective structural change to address this?

   • ACreate a new communication channel for each business unit to speak directly with the commander.
   • BHave the commander delegate all decision-making to the technical lead.
   • CAppoint a liaison officer to handle business unit communications and prioritize requests.
   • DInstruct business units to communicate directly with the technical team.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In a typical incident management team structure, which layer is responsible for strategic direction and resource allocation, while tactical teams execute specific technical tasks?

   • ACommand layer
   • BSupport layer
   • COperations layer
   • DCoordination layer
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A newly formed incident response team has just completed its first tabletop exercise. During the exercise, team members argued about the best approach to contain a simulated malware outbreak, and some members were reluctant to share information with each other. The team leader wants to accelerate the team's development. What is the most effective next step?

   • AConduct a structured after-action review to identify communication breakdowns and establish clear roles and expectations.
   • BReplace the team members who argued during the exercise with more experienced responders.
   • CImmediately assign the team to a real incident to force them to work together under pressure.
   • DCancel future exercises until the team has worked together informally for several months.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   During a data breach, the incident commander must decide whether to take a critical system offline for forensic preservation or keep it online to maintain business operations. The decision has legal, operational, and technical implications. What is the most appropriate decision-making process?

   • AThe decision is put to a vote among all team members to ensure consensus.
   • BThe technical lead makes the decision unilaterally based on the likelihood of further compromise.
   • CThe incident commander convenes a brief meeting with technical, legal, and business representatives to weigh the trade-offs and then makes the final call.
   • DThe decision is deferred until a full forensic analysis is completed.
   Reveal Solution Discussion Select an answer first