Incident Preparation GCIL Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A mid-sized organization is forming a new incident response team. The leadership wants to minimize costs and avoid hiring full-time security staff. They plan to assign incident response duties to existing IT staff as a collateral duty. The IT manager argues this is efficient, but the security lead warns of potential issues. Which concern is the most significant risk with this approach?

   • AThe organization will not be able to purchase the necessary incident response tools without a dedicated security budget.
   • BIT staff may lack the specialized skills and authority needed to make critical decisions during an incident, leading to delayed or incorrect responses.
   • CThe organization will fail compliance audits because incident response is not a dedicated full-time role.
   • DIT staff will be too busy with their regular duties to respond to incidents in a timely manner.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A large organization's incident response plan is a 200-page document that includes detailed technical runbooks for every system. During a recent incident, responders could not find the relevant procedures quickly, and the plan was not followed. The incident leader is tasked with improving the plan's usability. Which approach is most effective?

   • ARestructure the plan into a concise executive summary with role-based quick-reference cards and link to detailed runbooks separately.
   • BKeep the plan as is, but require all responders to memorize the entire document.
   • CMove the entire plan to a wiki and allow anyone to edit it without review.
   • DReduce the plan to a single page containing only the incident commander's contact information and the escalation path.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the purpose of maintaining a tool inventory for incident response?

   • ATo ensure that the necessary tools are available and functional when an incident occurs
   • BTo replace the need for trained personnel
   • CTo track employee vacation days
   • DTo provide a list of tools for marketing purposes
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company wants to improve its employees' ability to recognize and report phishing emails. The security team is designing a training and awareness program. Which approach is most likely to be effective?

   • APost posters in the office with examples of phishing emails.
   • BRequire employees to watch a one-time video about phishing.
   • CConduct regular simulated phishing campaigns and provide immediate feedback to employees who fall for them.
   • DSend a monthly newsletter with tips on identifying phishing emails.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a core component of an incident response plan?

   • AA list of employee performance reviews
   • BDetailed procedures for detecting, analyzing, and responding to incidents
   • CA list of all employee passwords
   • DA marketing strategy for public relations
   Reveal Solution Discussion Select an answer first