Incident Management Team Preparation GCIL Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   During an incident, what is the primary purpose of establishing a dedicated communication channel for the incident response team?

   • ATo replace all other forms of communication within the organization
   • BTo provide a public-facing channel for customers
   • CTo ensure that all incident-related communications are centralized and coordinated
   • DTo keep the incident response activities confidential from all employees
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   An organization is building a new incident management team. The team will include members from IT, security, legal, and PR. To ensure the team is ready to respond effectively, what is the most important training activity to conduct?

   • AA cross-functional tabletop exercise that simulates a realistic incident and requires coordination among all roles.
   • BLegal training on data breach notification laws for the entire team.
   • CPublic speaking training for the PR team only.
   • DTechnical training on the latest security tools for each team member.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A hospital's incident management team has completed a tabletop exercise simulating a phishing attack that leads to unauthorized access to patient records. During the after-action review, the team identifies that the public information officer did not know when to coordinate with the hospital's legal department before issuing a press release. What is the most effective next step to address this gap?

   • AUpdate the incident response plan to require legal review of all external communications before release.
   • BAdd a note in the incident log reminding the public information officer to contact legal during the next incident.
   • CConduct a targeted drill focused on the public information officer's role and communication approval workflow.
   • DReplace the public information officer with someone who has more media experience.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   In a typical incident management team structure, which reporting line is most accurate?

   • ATechnical responders report directly to the CEO
   • BThe Scribe reports to the Public Relations Officer
   • CFunctional leads report to the Incident Commander
   • DThe Incident Commander reports to the technical lead
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A city government is responding to a ransomware attack that affects multiple departments, including police, water, and finance. Each department has its own IT staff and has started independent response actions. The mayor has appointed a single incident commander. The incident commander wants to apply ICS to unify the response. Which approach is most effective?

   • ALet each department continue its independent response, but require them to send daily status reports to the incident commander.
   • BHave the incident commander issue direct orders to each department's IT staff, bypassing their department heads.
   • CEstablish a unified command with representatives from each affected department, and create a joint operations center to coordinate resources and information.
   • DCreate a single IT task force led by the police department's IT manager, since public safety is the top priority.
   Reveal Solution Discussion Select an answer first