Incident Management Team Preparation GCIL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A large organization is responding to a multi-site security incident. The incident commander (IC) has established an Incident Command System (ICS) structure. Several functional areas are operating, including operations, planning, logistics, and finance. The IC notices that the operations section chief is also making decisions about resource allocation and budget approvals. What is the best course of action?

   • AReassign the resource allocation and budget decisions to the logistics and finance sections, respectively.
   • BAllow the operations chief to continue, as they have the best understanding of the incident.
   • CHave the IC personally take over all resource and budget decisions to reduce confusion.
   • DCreate a new section specifically for resource allocation and budget to avoid conflict.
   Reveal Solution Discussion Select an answer first
2. 22application · easy

   A security analyst discovers a potential data breach and escalates it to the incident commander (IC). The IC needs to inform the executive team. What is the most appropriate communication channel for this escalation?

   • AAn email from the IC to the executive team with a summary of the incident and current status.
   • BA public announcement to all employees via the company intranet.
   • CA direct phone call from the analyst to the CEO.
   • DA message in the general incident response chat channel.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company discovers a data breach involving customer personal data. The incident team has been activated. The CEO wants to notify law enforcement immediately, while the legal counsel advises waiting until the investigation confirms the scope. What is the most appropriate action?

   • AAsk the vendor to notify law enforcement on behalf of the company to maintain neutrality.
   • BContact law enforcement immediately as the CEO requested, since they are the ultimate authority.
   • CHave the PR team issue a public statement before any law enforcement contact to manage the narrative.
   • DFollow legal counsel's advice to wait until the investigation confirms the scope, then notify law enforcement through the designated channel.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization is planning a tabletop exercise to test its incident response plan. The goal is to evaluate the team's decision-making under pressure and identify gaps in communication. Which approach would best achieve this goal?

   • AReveal the scenario in stages, with injects that introduce new information and force decisions.
   • BFocus only on technical containment steps, avoiding communication and decision-making scenarios.
   • CHave each participant work independently to solve the scenario, then compare answers.
   • DProvide the full incident scenario in advance so participants can prepare thoroughly.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A regional bank is responding to a widespread ATM outage caused by a malware infection. The incident commander (IC) has implemented an Incident Command System (ICS) structure. The operations section is focused on containment, while the planning section is developing a recovery plan. The IC is receiving conflicting reports about the scope of the infection. What is the most critical action for the IC to take?

   • ADirect the planning section to finalize the recovery plan immediately, assuming the current scope is accurate.
   • BOrder the operations section to expand containment to all ATMs, regardless of confirmed infection.
   • CInstruct the operations section to provide a verified status update to the planning section before finalizing the recovery plan.
   • DEstablish a unified command with the ATM vendor to coordinate both containment and recovery efforts.
   Reveal Solution Discussion Select an answer first