An incident management team is defining decision-making authority. Which of the following are appropriate elements of a decision-making authority framework? (Select all that apply.)

Authority is delegated to section chiefs for decisions within their functional area.

Decision-making authority is documented in the incident response plan.

Critical decisions that affect the entire organization are escalated to the executive team.

All team members have equal authority to make any decision.

The incident commander has final authority over all incident decisions.

During an incident, the incident commander (IC) assigns a team member to be the scribe. The scribe is responsible for maintaining the incident log. Which of the following is the primary responsibility of the scribe?

Communicating with external media outlets.

Coordinating with law enforcement agencies.

Recording all significant actions, decisions, and communications in a chronological log.

Making final decisions on containment strategies.

A financial institution is responding to a suspected insider threat. The incident commander has established a communication protocol that includes a secure chat channel for the response team and a policy that all external communications must be approved by the incident commander. During the response, a team member accidentally posts sensitive information to the public social media account instead of the secure chat. What is the most important immediate action?

Delete the post and issue a public statement that the account was compromised.

Ignore the post and continue the response, as it will likely be overlooked.

Delete the post, notify the incident commander, and document the incident in the incident log.

Have the team member post a correction on the same social media account.

What is the primary purpose of establishing a clear hierarchy within an incident management team?

To eliminate the need for communication

To provide a clear chain of command and accountability

To ensure every decision is made by consensus

To distribute decision-making equally among all team members

What is a primary purpose of maintaining detailed documentation during an incident?

To provide a basis for post-incident review and legal defense

To replace the need for communication

To increase the workload of the incident team

To satisfy the requirements of external auditors only

GIAC Cyber Incident Leader

Domain 2Objective 2

Incident Management Team Preparation GCIL Practice Questions (Page 4)

Part of the Incident Preparation and Prevention domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 16–20

16application · medium · select all that apply
An incident management team is defining decision-making authority. Which of the following are appropriate elements of a decision-making authority framework? (Select all that apply.)
Select an answer first
17application · easy
During an incident, the incident commander (IC) assigns a team member to be the scribe. The scribe is responsible for maintaining the incident log. Which of the following is the primary responsibility of the scribe?
Select an answer first
18expert · hard
A financial institution is responding to a suspected insider threat. The incident commander has established a communication protocol that includes a secure chat channel for the response team and a policy that all external communications must be approved by the incident commander. During the response, a team member accidentally posts sensitive information to the public social media account instead of the secure chat. What is the most important immediate action?
Select an answer first
19foundation · easy
What is the primary purpose of establishing a clear hierarchy within an incident management team?
Select an answer first
20foundation · easy
What is a primary purpose of maintaining detailed documentation during an incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.