Incident Management Team Preparation GCIL Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   After a significant security incident, the incident commander schedules a lessons-learned meeting. The goal is to improve future response efforts. Which approach best achieves this objective?

   • AFocus the meeting on identifying individual mistakes and assigning blame.
   • BLimit the meeting to the incident commander and senior leadership to avoid airing internal issues.
   • CImmediately update the incident response plan without discussion to save time.
   • DReview the incident timeline, discuss what worked and what did not, and document actionable improvements.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A multinational corporation is responding to a data breach that may affect customers in multiple jurisdictions. The incident team is documenting the incident. The legal counsel requests that certain details be kept out of the written incident log to avoid potential legal exposure. What is the most appropriate response?

   • ARecord all details in the log, as the log is a legal record and must be complete.
   • BStop documenting the incident until legal counsel resolves the issue.
   • CComply with legal counsel's request and omit the details from the log.
   • DDocument the details in a separate, privileged communication log that is not shared broadly.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company's incident management team has recently been formed. The team members have diverse backgrounds but have never worked together in an incident. The incident commander wants to improve the team's readiness before a real incident occurs. Which activity is most effective for building team cohesion and testing the incident plan?

   • APurchase new incident management software and train each member on its features.
   • BDistribute the incident response plan to all team members for individual review.
   • CConduct a tabletop exercise with realistic scenarios and facilitated discussion.
   • DSchedule a social team-building event to build personal relationships.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A multinational corporation suffers a ransomware attack that encrypts systems in its European and Asian data centers. The incident commander is the global CISO. The European legal counsel advises that paying the ransom may violate EU sanctions regulations, while the Asian business unit leader insists on immediate payment to restore operations. The CEO is available but has delegated operational authority to the CISO. The CISO must decide whether to pay. Which action best balances legal risk, business impact, and decision authority?

   • AThe CISO escalates the decision to the CEO with a recommendation that includes legal analysis and business impact, while continuing containment efforts.
   • BThe CISO authorizes payment but instructs the finance team to route the payment through a third-party intermediary to avoid sanctions.
   • CThe CISO makes the final decision to pay, based on the business unit leader's urgency and the need to restore operations quickly.
   • DThe CISO defers to European legal counsel and refuses to pay, regardless of business impact.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   After a lessons learned review, what is the typical next step?

   • AUpdate the incident response plan and procedures
   • BDisband the incident response team
   • CArchive the report and take no further action
   • DImmediately notify the media of the findings
   Reveal Solution Discussion Select an answer first