A manufacturing company is developing its incident response capabilities. The leadership team has approved a budget for new security tools and training. The incident leader is now tasked with ensuring the organization is prepared for a potential ransomware attack. Which combination of preparation activities should be prioritized?

Develop a ransomware-specific response procedure, acquire and test backup and recovery tools, and conduct a tabletop exercise with the response team.

Hire an external consultant to write the incident response plan and then file it away for future reference.

Purchase cyber insurance and wait for an incident to occur to test the response plan.

Focus exclusively on purchasing the most advanced endpoint detection and response (EDR) tools available.

What is the primary responsibility of the incident response team lead?

To coordinate and direct the incident response efforts

To perform all technical analysis single-handedly

To communicate only with external media outlets

To ensure that no evidence is ever collected

A company is forming an incident response team. The team will include members from IT, security, legal, HR, and public relations. The CISO wants to ensure that the team operates effectively during an incident. Which role is essential to define in the team structure?

Public relations lead, who manages external communications.

HR representative, who handles personnel issues.

Legal counsel, who advises on regulatory and legal issues.

Incident commander, who has overall authority and coordinates the response effort.

A mid-sized financial services firm is revising its incident response plan. The CISO wants the plan to clearly define who can declare an incident, who makes the final call on containment versus eradication, and who communicates with regulators. The plan must also specify how often the plan is reviewed and updated. Which approach best satisfies these requirements?

Include a roles-and-responsibilities matrix, a decision authority hierarchy, and a scheduled review cycle in the plan.

List all team members and their contact information, but defer all major decisions to the CISO.

Create a separate communication plan and leave decision-making to the incident commander on a case-by-case basis.

Document only the technical containment steps and rely on the team's experience for escalation decisions.

Why is it important to regularly update and patch incident response tools?

To comply with a requirement to change tools annually

To make the tools more difficult for employees to use

To ensure the tools can detect and analyze the latest threats

To reduce the need for training on the tools

GIAC Cyber Incident Leader

Domain 2Objective 1

Incident Preparation GCIL Practice Questions (Page 5)

Part of the Incident Preparation and Prevention domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 21–25

21application · medium
A manufacturing company is developing its incident response capabilities. The leadership team has approved a budget for new security tools and training. The incident leader is now tasked with ensuring the organization is prepared for a potential ransomware attack. Which combination of preparation activities should be prioritized?
Select an answer first
22foundation · easy
What is the primary responsibility of the incident response team lead?
Select an answer first
23application · medium
A company is forming an incident response team. The team will include members from IT, security, legal, HR, and public relations. The CISO wants to ensure that the team operates effectively during an incident. Which role is essential to define in the team structure?
Select an answer first
24application · medium
A mid-sized financial services firm is revising its incident response plan. The CISO wants the plan to clearly define who can declare an incident, who makes the final call on containment versus eradication, and who communicates with regulators. The plan must also specify how often the plan is reviewed and updated. Which approach best satisfies these requirements?
Select an answer first
25foundation · easy
Why is it important to regularly update and patch incident response tools?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Incident Preparation GCIL Practice Questions (Page 5)

Questions 21–25

What is the primary responsibility of the incident response team lead?

A company is forming an incident response team. The team will include members from IT, security, legal, HR, and public relations. The CISO wants to ensure that the team operates effectively during an incident. Which role is essential to define in the team structure?

Why is it important to regularly update and patch incident response tools?

Keep studying — Incident Preparation and Prevention