Which activity is considered a readiness activity for an incident management team?

Waiting for an actual incident to occur

Upgrading personal devices for team members

Which of the following is typically included in an incident report?

A timeline of events and actions taken

A list of all employees' performance reviews

Personal opinions of team members

Speculation about the attacker's motives

What is a core principle of the Incident Command System (ICS) when applied to cybersecurity incidents?

A single incident commander with overall authority

The team operates without a defined hierarchy

Communications are restricted to written memos only

All team members have equal decision-making authority

A global organization's incident response team is handling a malware outbreak that affects offices in three time zones. The incident commander needs to ensure that all team members receive consistent updates and that critical decisions are escalated quickly. Which communication protocol is most effective?

Hold a daily conference call at a fixed time for all updates.

Allow each regional office to communicate independently and report to the incident commander at the end of the day.

Use a single email distribution list for all updates and decisions.

Establish a dedicated incident chat channel for real-time updates and a documented escalation path for urgent decisions.

GIAC Cyber Incident Leader

Domain 2Objective 2

Incident Management Team Preparation GCIL Practice Questions (Page 6)

Part of the Incident Preparation and Prevention domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 26–30

26foundation · easy
Which activity is considered a readiness activity for an incident management team?
Select an answer first
27foundation · easy
Which of the following is typically included in an incident report?
Select an answer first
28application · medium · select all that apply
An organization is establishing an incident management team. Which of the following are key roles that should be included in the team structure? (Select all that apply.)
Select an answer first
29foundation · easy
What is a core principle of the Incident Command System (ICS) when applied to cybersecurity incidents?
Select an answer first
30application · medium
A global organization's incident response team is handling a malware outbreak that affects offices in three time zones. The incident commander needs to ensure that all team members receive consistent updates and that critical decisions are escalated quickly. Which communication protocol is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Incident Management Team Preparation GCIL Practice Questions (Page 6)

Questions 26–30

Which activity is considered a readiness activity for an incident management team?

Which of the following is typically included in an incident report?

An organization is establishing an incident management team. Which of the following are key roles that should be included in the team structure? (Select all that apply.)

What is a core principle of the Incident Command System (ICS) when applied to cybersecurity incidents?

Keep studying — Incident Preparation and Prevention