A large organization is establishing an incident management team. The team will include a technical lead, a communications lead, a legal advisor, and a business continuity coordinator. The organization wants clear reporting lines and accountability. Which structure is most appropriate?

Each functional lead reports to the incident commander, who has overall authority.

The team operates as a peer group with no designated leader, making decisions by consensus.

The technical lead reports to the communications lead, who reports to the incident commander.

All team members report directly to the CEO during an incident.

How is decision-making authority typically delegated within an incident management team?

Authority is delegated based on the specific role and expertise of team members

Authority is given to the most vocal team member

Authority is only held by external consultants

Authority is shared equally among all team members

In the Incident Command System, what is the role of the 'Planning Section'?

To handle external communications with the media

To provide direct tactical response to the incident

To manage financial and administrative costs

To collect, evaluate, and disseminate incident information

What is the typical escalation procedure when a first-level responder encounters an incident that exceeds their authority?

They contact their supervisor or the incident commander for guidance

They immediately shut down all systems to prevent further damage

They handle the incident independently to avoid bothering management

They document the incident and wait for the next scheduled meeting

What is the primary purpose of a 'lessons learned' review after an incident?

To identify what went well and what needs improvement

To create a record for legal defense only

To justify the incident response budget

GIAC Cyber Incident Leader

Domain 2Objective 2

Incident Management Team Preparation GCIL Practice Questions (Page 7)

Part of the Incident Preparation and Prevention domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 31–35

31application · medium
A large organization is establishing an incident management team. The team will include a technical lead, a communications lead, a legal advisor, and a business continuity coordinator. The organization wants clear reporting lines and accountability. Which structure is most appropriate?
Select an answer first
32foundation · easy
How is decision-making authority typically delegated within an incident management team?
Select an answer first
33foundation · easy
In the Incident Command System, what is the role of the 'Planning Section'?
Select an answer first
34foundation · easy
What is the typical escalation procedure when a first-level responder encounters an incident that exceeds their authority?
Select an answer first
35foundation · easy
What is the primary purpose of a 'lessons learned' review after an incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.