After a major incident, the incident team is conducting a continuous improvement review. Which of the following are appropriate steps in the lessons-learned process? (Select all that apply.)

Updating the incident response plan based on findings.

Identifying root causes of any failures or gaps.

Assigning action items with owners and deadlines.

Blaming individuals for mistakes to prevent recurrence.

Conducting a structured after-action review with all key participants.

A healthcare organization experiences a ransomware attack that encrypts patient records. The incident team is activated. The CEO wants to pay the ransom to restore data quickly, but the legal counsel advises against it due to potential sanctions. The incident commander (IC) must decide on the next step. What should the IC do?

Follow legal counsel's advice and refuse to pay the ransom, focusing on recovery from backups.

Follow the CEO's direction to pay the ransom, as the CEO has ultimate authority.

Contact the FBI to make the decision on whether to pay the ransom.

Facilitate a decision-making session with the CEO, legal counsel, and key stakeholders to weigh the risks and alternatives.

A company is responding to a cyber incident that may involve criminal activity. The incident team is considering coordinating with external entities. Which of the following are appropriate external entities to coordinate with during the incident? (Select all that apply.)

The company's internet service provider

Competing companies in the same industry

The company's public relations firm

The company's external legal counsel

A manufacturing company activates its incident management team after a ransomware infection halts production. The CEO is traveling and unreachable. The plant manager demands immediate action to restore systems, while the IT director wants to preserve evidence. Who should have the authority to make the final decision on whether to pay the ransom and restore from backups?

The IT director, because technical expertise determines the best recovery path.

The incident commander, acting under pre-delegated authority from the CEO.

The plant manager, because production downtime is the most urgent business impact.

The legal counsel, because ransom payments involve regulatory and criminal law considerations.

How do drills differ from tabletop exercises?

Drills are theoretical, while tabletop exercises are practical

Drills are only for management, while tabletop exercises are for technical staff

Drills are more operational and may involve actual system actions

Drills are not useful for incident response

GIAC Cyber Incident Leader

Domain 2Objective 2

Incident Management Team Preparation GCIL Practice Questions (Page 1)

Part of the Incident Preparation and Prevention domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 1–5

1application · medium · select all that apply
After a major incident, the incident team is conducting a continuous improvement review. Which of the following are appropriate steps in the lessons-learned process? (Select all that apply.)
Select an answer first
2expert · hard
A healthcare organization experiences a ransomware attack that encrypts patient records. The incident team is activated. The CEO wants to pay the ransom to restore data quickly, but the legal counsel advises against it due to potential sanctions. The incident commander (IC) must decide on the next step. What should the IC do?
Select an answer first
3application · medium · select all that apply
A company is responding to a cyber incident that may involve criminal activity. The incident team is considering coordinating with external entities. Which of the following are appropriate external entities to coordinate with during the incident? (Select all that apply.)
Select an answer first
4application · medium
A manufacturing company activates its incident management team after a ransomware infection halts production. The CEO is traveling and unreachable. The plant manager demands immediate action to restore systems, while the IT director wants to preserve evidence. Who should have the authority to make the final decision on whether to pay the ransom and restore from backups?
Select an answer first
5foundation · easy
How do drills differ from tabletop exercises?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Incident Management Team Preparation GCIL Practice Questions (Page 1)

Questions 1–5

After a major incident, the incident team is conducting a continuous improvement review. Which of the following are appropriate steps in the lessons-learned process? (Select all that apply.)

A company is responding to a cyber incident that may involve criminal activity. The incident team is considering coordinating with external entities. Which of the following are appropriate external entities to coordinate with during the incident? (Select all that apply.)

How do drills differ from tabletop exercises?

Keep studying — Incident Preparation and Prevention