Incident Preparation GCIL Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization's incident response team relies on a commercial endpoint detection and response (EDR) tool. During a recent incident, the tool failed to detect a known malware variant because its signature database was outdated. The incident leader wants to prevent this from happening again. Which action is most appropriate?

   • AImplement a formal patch and update management process for the EDR tool, including regular signature updates and verification.
   • BDisable the EDR tool's signature-based detection and rely solely on behavioral analysis.
   • CWait for the next incident to see if the tool performs better.
   • DReplace the EDR tool with a different vendor's product that is guaranteed to detect all malware.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A global organization is establishing a 24/7 incident response capability. The team will be distributed across three regions: Americas, Europe, and Asia-Pacific. The incident leader must design a team structure that ensures coverage and effective coordination. Which structure is most appropriate?

   • AOutsource all incident response to a managed security service provider (MSSP) and eliminate the internal team.
   • BCreate a single global team that works from one location and uses a follow-the-sun model with shifts.
   • CAssign all incident response duties to the Americas team and have them work overtime to cover other regions.
   • DEstablish regional incident response teams with a global coordinator who ensures consistency and handles cross-region escalations.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A retail company is preparing for the holiday shopping season, which is a peak period for cyber attacks. The incident response team has a limited budget and needs to ensure it is prepared. Which preparation activity should be prioritized to address the increased threat level?

   • AConduct a focused threat assessment for the holiday season and update the incident response plan to address the most likely attack scenarios.
   • BDelay all preparation activities until after the holiday season when the threat level decreases.
   • CHire temporary security staff to monitor the network during the holiday season.
   • DPurchase additional security tools even if they are not fully integrated with the existing infrastructure.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An incident response team is preparing for a potential ransomware attack. The team needs to ensure that they have the necessary tools and resources to respond effectively. Which resource is most critical to have prepared in advance?

   • AA tested and verified offline backup of critical systems and data.
   • BA list of cybersecurity insurance contacts.
   • CA collection of forensic analysis tools.
   • DA pre-written press release template.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A multinational corporation is updating its incident response plan. The legal team requires that the plan include specific data breach notification timelines for each country where the company operates. The security team wants the plan to be agile and easy to update. Which approach best satisfies both requirements?

   • ACreate a single global notification timeline that applies to all countries.
   • BInclude a high-level notification policy in the main plan and maintain a separate appendix with country-specific legal requirements and timelines.
   • CExclude legal requirements from the incident response plan and handle them separately during an incident.
   • DEmbed all country-specific legal requirements directly into the main incident response plan.
   Reveal Solution Discussion Select an answer first