An incident management team is facing a critical decision: whether to isolate a compromised server that may contain the only evidence of an attacker's lateral movement. The team is split between immediate isolation and continued monitoring. The incident commander needs a decision within 15 minutes. Which decision-making approach is most appropriate?

A pre-defined decision matrix that weighs the risk of losing evidence against the risk of further compromise.

Defer the decision to the most senior technical analyst.

Consensus-based decision making, where the team discusses until everyone agrees.

Flip a coin to make a quick decision and move on.

When coordinating with law enforcement during an incident, what is a primary responsibility of the incident team?

Delay all response actions until law enforcement arrives

Preserve evidence and share relevant information while respecting legal and operational constraints

Provide law enforcement with full access to all systems without restrictions

Transfer all incident documentation to law enforcement immediately

Which of the following is a key component of an effective after-action review process?

Involving only the incident commander

Creating an action plan with assigned owners and timelines for improvements

Focusing only on what went wrong

Keeping the results confidential to avoid embarrassment

What is the primary purpose of establishing a relationship with external vendors before an incident occurs?

To provide vendors with unrestricted access to the network

To ensure vendors are available for social events

To transfer all incident response responsibilities to the vendor

To have pre-negotiated contracts and contact points for rapid support during an incident

GIAC Cyber Incident Leader

Domain 6Objective 1

Incident Management Team Development GCIL Practice Questions (Page 9)

Part of the Team Development and Improvement domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 41–45

41application · medium
An incident management team is facing a critical decision: whether to isolate a compromised server that may contain the only evidence of an attacker's lateral movement. The team is split between immediate isolation and continued monitoring. The incident commander needs a decision within 15 minutes. Which decision-making approach is most appropriate?
Select an answer first
42foundation · easy
When coordinating with law enforcement during an incident, what is a primary responsibility of the incident team?
Select an answer first
43foundation · easy
Which of the following is a key component of an effective after-action review process?
Select an answer first
44foundation · easy
During which stage of team development do team members typically experience conflicts and disagreements about roles, responsibilities, and approaches?
Select an answer first
45foundation · easy
What is the primary purpose of establishing a relationship with external vendors before an incident occurs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Incident Management Team Development GCIL Practice Questions (Page 9)

Questions 41–45

When coordinating with law enforcement during an incident, what is a primary responsibility of the incident team?

Which of the following is a key component of an effective after-action review process?

During which stage of team development do team members typically experience conflicts and disagreements about roles, responsibilities, and approaches?

What is the primary purpose of establishing a relationship with external vendors before an incident occurs?

Keep studying — Team Development and Improvement