Incident Management Team Preparation GCIL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A regional utility company is responding to a cyber incident that affects multiple districts. The incident commander wants to apply ICS principles to manage the response. Which structure best reflects ICS?

   • AA single command post where the incident commander directs all responders directly.
   • BA hierarchical structure where the IT manager makes all decisions and other departments follow orders.
   • CA unified command with representatives from IT, operations, and legal, supported by section chiefs for operations, planning, logistics, and finance.
   • DA decentralized structure where each district runs its own independent response and reports to the board.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A mid-sized e-commerce company has activated its incident management team after a website defacement. The team includes a technical lead, a communications lead, a legal advisor, and a business unit representative. The incident commander is the CISO. Which responsibility is most appropriate for the business unit representative?

   • ADirecting the technical containment actions to restore the website.
   • BApproving the final public statement about the defacement.
   • CMaking the final decision on whether to involve law enforcement.
   • DProviding input on customer impact and business continuity priorities.
   Reveal Solution Discussion Select an answer first
4. 8application · medium · select all that apply

   During an incident, the incident commander (IC) needs to establish communication protocols. Which of the following are appropriate components of an effective communication protocol? (Select all that apply.)

   • AA policy that all team members can communicate directly with external media.
   • BA requirement for regular status updates from each functional area.
   • CA designated primary communication channel for the team.
   • DA rule that all communication must be in writing and never verbal.
   • EAn escalation path for notifying senior management.
   Check answers Discussion Select an answer first
5. 9application · medium · select all that apply

   An organization is implementing the Incident Command System (ICS) for incident response. Which of the following are key principles of ICS? (Select all that apply.)

   • ADelegation of authority based on roles and responsibilities.
   • BClear chain of command and reporting lines.
   • CFlexible structure that can expand or contract as needed.
   • DAll decisions must be made by consensus of the entire team.
   • EUnified command structure with a single incident commander.
   Check answers Discussion Select an answer first
6. 10expert · hard

   An organization has conducted several tabletop exercises, but the incident team continues to make the same communication mistakes during real incidents. The exercises are well-attended and participants report they are valuable. What is the most likely reason the exercises are not improving real-world performance?

   • AThe exercises are too easy and do not challenge the team.
   • BThe exercises do not include realistic communication constraints, such as time pressure and incomplete information.
   • CThe exercises are too frequent, causing the team to become complacent.
   • DThe exercises are not documented, so lessons are not captured.
   Reveal Solution Discussion Select an answer first