An organization's incident response team conducts a tabletop exercise every year. After each exercise, the team updates the incident response plan based on lessons learned. However, the team has noticed that the same issues keep appearing in each exercise. What should the incident leader do to improve the continuous improvement process?

Analyze the recurring issues to identify root causes and implement corrective actions that address the underlying problems, not just the symptoms.

Assign the task of updating the plan to a single person who can make all the necessary changes.

Change the scenario for the next exercise to avoid the recurring issues.

Stop conducting tabletop exercises because they are not leading to improvement.

A small company is starting to develop its incident response capability. The IT manager wants to ensure that the company is prepared to handle security incidents effectively. Which activity is the most important first step in incident preparation?

Purchase advanced security tools and deploy them across the network.

Hire a third-party incident response firm to be on retainer.

Conduct a security awareness training for all employees.

Develop an incident response policy that defines the scope, objectives, and authority for incident response.

A university's incident response team is planning its annual training program. The team includes full-time security analysts, part-time student workers, and faculty liaisons. The budget allows for one training event per year. Which training approach best addresses the needs of this diverse team?

Conduct a role-based training session where each group receives instruction tailored to their specific responsibilities in an incident.

Focus the training exclusively on the full-time security analysts and exclude part-time workers and liaisons.

Replace the training session with a new incident response tool deployment.

Provide the same general incident response training to all team members regardless of their role.

What is the primary purpose of incident preparation in the incident management lifecycle?

To replace the need for ongoing monitoring and detection controls

To ensure the organization is ready to detect, respond to, and recover from incidents effectively

To assign blame and determine fault after an incident has occurred

To eliminate the possibility of any security incident occurring

Which of the following is an example of an incident response training activity?

Installing new software on employee computers

Performing a routine backup of servers

Reviewing firewall logs for anomalies

GIAC Cyber Incident Leader

Domain 2Objective 1

Incident Preparation GCIL Practice Questions (Page 4)

Part of the Incident Preparation and Prevention domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 16–20

16application · medium
An organization's incident response team conducts a tabletop exercise every year. After each exercise, the team updates the incident response plan based on lessons learned. However, the team has noticed that the same issues keep appearing in each exercise. What should the incident leader do to improve the continuous improvement process?
Select an answer first
17application · medium
A small company is starting to develop its incident response capability. The IT manager wants to ensure that the company is prepared to handle security incidents effectively. Which activity is the most important first step in incident preparation?
Select an answer first
18application · medium
A university's incident response team is planning its annual training program. The team includes full-time security analysts, part-time student workers, and faculty liaisons. The budget allows for one training event per year. Which training approach best addresses the needs of this diverse team?
Select an answer first
19foundation · easy
What is the primary purpose of incident preparation in the incident management lifecycle?
Select an answer first
20foundation · easy
Which of the following is an example of an incident response training activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.