Incident Management Team Preparation GCIL Practice Questions (Page 11)

Questions 51–53

1. 51application · medium

   A financial services firm discovers a data breach involving customer records. The incident commander needs to notify law enforcement, coordinate with a forensic vendor, and prepare a public statement. Which communication approach best supports these concurrent activities?

   • ADelay all external communications until the investigation is complete to avoid inaccurate statements.
   • BAssign a liaison officer to law enforcement, a vendor coordinator for the forensic team, and a public information officer for the statement.
   • CHave the incident commander personally handle all external communications to ensure consistency.
   • DInstruct the forensic vendor to communicate directly with law enforcement and the media to reduce internal workload.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which incident management team role is responsible for documenting all key decisions, actions, and findings during an incident?

   • APublic Relations Officer
   • BIncident Commander
   • CScribe/Recorder
   • DLegal Counsel
   Reveal Solution Discussion Select an answer first
3. 53expert · hard

   A healthcare provider suffers a data breach involving protected health information. The incident commander must coordinate with law enforcement, a forensic vendor, and the organization's public relations firm. The forensic vendor has identified evidence of criminal activity and wants to share it with law enforcement immediately. The PR firm wants to issue a press release as soon as possible. Legal counsel advises that premature disclosure could compromise the investigation. What is the best course of action?

   • ADesignate a single liaison to law enforcement, require the forensic vendor to route evidence through that liaison, and coordinate the PR statement with legal counsel.
   • BInstruct the forensic vendor to withhold all evidence from law enforcement until the investigation is complete.
   • CHave the PR firm issue a statement that confirms the breach but provides no details, without consulting legal.
   • DAllow the forensic vendor to share evidence directly with law enforcement and let the PR firm issue a statement immediately.
   Reveal Solution Discussion Select an answer first