Incident Management Team Preparation GCIL Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the purpose of conducting regular training for incident management team members?

   • ATo guarantee that no incidents will occur
   • BTo replace the need for documentation
   • CTo satisfy the requirements of external auditors only
   • DTo ensure team members are familiar with their roles and procedures
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   After a major incident, the incident management team conducts a lessons-learned review. The team identifies that the documentation was incomplete because team members were too busy with operational tasks to update logs. The team also notes that the incident commander was not aware of several key decisions made by the technical lead. Which improvement is most likely to address both issues?

   • AAssign a dedicated scribe to maintain the incident log and require the technical lead to report all decisions to the incident commander.
   • BIntegrate documentation into the incident management workflow by using a shared tool that requires decision logging, and hold a brief shift-change briefing to review decisions.
   • CImplement a policy that all decisions must be documented in the incident log within 15 minutes, regardless of operational urgency.
   • DReduce the number of decisions that require incident commander approval to lessen the documentation burden.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary role of the public relations (PR) team during an incident?

   • ATo manage external communications and protect the organization's reputation
   • BTo coordinate with law enforcement on legal matters
   • CTo conduct the technical forensic investigation
   • DTo make all final decisions regarding incident response
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Who typically holds the authority to make critical decisions during an incident, such as whether to shut down a critical system?

   • AThe Chief Executive Officer (CEO)
   • BThe most senior technical engineer on the team
   • CThe external legal counsel
   • DThe Incident Commander
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   During a ransomware incident, the incident commander (IC) is off-site and unreachable. The deputy IC has been delegated authority to make operational decisions. A critical decision to isolate a core business system arises, which will cause significant downtime. The deputy IC is uncertain whether to proceed without the IC's approval. What should the deputy IC do?

   • AProceed with the isolation based on the delegated authority and inform the IC as soon as possible.
   • BEscalate to the public relations lead to assess the reputational impact before deciding.
   • CWait until the IC is reachable to avoid overstepping delegated authority.
   • DCall a vote among the team members to ensure consensus before acting.
   Reveal Solution Discussion Select an answer first