Incident Preparation GCIL Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is resource allocation an important part of incident preparation?

   • AIt ensures that the incident response team has the necessary budget, tools, and personnel to respond effectively
   • BIt guarantees that no security incidents will ever occur
   • CIt is only necessary for large enterprises, not small organizations
   • DIt allows the organization to avoid conducting any training for staff
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the incident management lifecycle, which phase typically occurs BEFORE an incident is detected?

   • AContainment
   • BPreparation
   • CEradication
   • DLessons Learned
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After a significant phishing incident, the incident response team conducts a post-incident review. The review identifies that the incident response plan did not include a clear process for isolating infected endpoints, and that the team lacked a predefined communication template for notifying affected users. The CISO asks the team to update the plan. What is the most appropriate next step?

   • ADocument the lessons learned in a separate file and leave the plan unchanged.
   • BReplace the entire plan with a new one based on the lessons learned.
   • CShare the lessons learned with the team and rely on their memory during future incidents.
   • DUpdate the plan to include the isolation procedure and a communication template, then schedule a tabletop exercise to validate the changes.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has conducted multiple tabletop exercises and real incident responses over the past year. The post-incident reviews consistently identify that the incident response plan is too generic and does not provide specific guidance for different types of incidents, such as data breaches, ransomware, and insider threats. The CISO wants to improve the plan without making it overly complex. Which approach is most effective?

   • ARewrite the main plan to include detailed procedures for every possible incident type.
   • BDevelop a set of playbooks for the most common incident types, while keeping the main plan as a high-level framework.
   • CKeep the plan generic and rely on the team's experience to handle different incidents.
   • DCreate a separate plan for each incident type and remove the main plan.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An organization's incident response team has recently experienced a high turnover of staff. The new team members are unfamiliar with the organization's incident response procedures. The CISO wants to ensure that the team is ready to respond to incidents as quickly as possible. The budget for training is limited, and the team cannot afford to take extended time away from their duties. Which training approach is most effective given these constraints?

   • ARequire new team members to complete a comprehensive online training course before they can participate in any incident response activities.
   • BAssign new team members to low-priority incidents and let them learn by doing without supervision.
   • CImplement a mentorship program where new team members shadow experienced analysts during live incidents and participate in regular tabletop exercises.
   • DProvide new team members with a copy of the incident response plan and ask them to read it on their own time.
   Reveal Solution Discussion Select an answer first