What is the primary purpose of a tabletop exercise in incident response?

To test the performance of network hardware

To test the team's decision-making and communication in a simulated scenario

To replace the need for real incident response

To provide a platform for vendors to sell products

An organization is planning training and readiness activities for its incident management team. Which of the following activities are appropriate for maintaining team readiness? (Select all that apply.)

Providing role-specific training for each team member.

Conducting regular tabletop exercises.

Reviewing and updating the incident response plan after each exercise.

Waiting until an incident occurs to train the team.

Conducting a full-scale simulation with actual systems.

When coordinating with law enforcement during an incident, what is a key consideration for the incident team?

The team should immediately delete all logs to prevent exposure

The team should preserve evidence and document all actions taken

Law enforcement should be excluded from all incident details to protect privacy

Law enforcement should be given unrestricted access to all systems immediately

During a prolonged incident, the incident commander notices that shift changes are causing loss of critical information. Team members are unsure what actions were taken and what decisions were made before they arrived. What should the incident commander implement to address this issue?

Record all meetings and distribute the recordings to the incoming shift.

Establish a structured shift-change briefing using the incident action plan and an updated incident log.

Require each team member to maintain a personal notebook and brief their replacement verbally.

Extend each shift until the incident is resolved to avoid handoffs.

GIAC Cyber Incident Leader

Domain 2Objective 2

Incident Management Team Preparation GCIL Practice Questions (Page 3)

Part of the Incident Preparation and Prevention domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 11–15

11foundation · easy
What is the primary purpose of a tabletop exercise in incident response?
Select an answer first
12application · medium · select all that apply
An organization is planning training and readiness activities for its incident management team. Which of the following activities are appropriate for maintaining team readiness? (Select all that apply.)
Select an answer first
13foundation · easy
When coordinating with law enforcement during an incident, what is a key consideration for the incident team?
Select an answer first
14application · medium
During a prolonged incident, the incident commander notices that shift changes are causing loss of critical information. Team members are unsure what actions were taken and what decisions were made before they arrived. What should the incident commander implement to address this issue?
Select an answer first
15foundation · easy
In an incident management team, which role is primarily responsible for coordinating the technical investigation and directing the actions of the technical responders?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.