Incident Preparation GCIL Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a common role within an incident response team?

   • AChief executive officer
   • BHuman resources specialist
   • CFacilities manager
   • DForensic analyst
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization has just completed a tabletop exercise for a ransomware scenario. The exercise revealed that several team members were unsure how to access the incident response plan and did not know who to contact first. The CISO wants to address these gaps with a training program. Which training approach is most effective?

   • AConduct a hands-on workshop where team members practice accessing the plan and following the escalation procedure.
   • BSend a company-wide email with the plan attached and a list of contacts.
   • CSchedule a lecture-style presentation on the importance of incident response.
   • DDistribute a quick-reference card with the plan URL and key contacts.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A hospital's incident response team completed a tabletop exercise for a phishing attack. The exercise revealed that nursing staff did not know how to report a suspected phishing email, and the IT helpdesk was unaware of the escalation path to the security team. According to the preparation phase of the incident management lifecycle, which action should the incident leader prioritize?

   • AUpdate the incident response plan to include a clear reporting procedure and conduct targeted training for nursing and helpdesk staff on the escalation path.
   • BImmediately terminate the email accounts that were compromised during the tabletop exercise.
   • CDeploy a new email filtering solution to reduce the number of phishing emails that reach the nursing staff.
   • DConduct a root cause analysis to determine why the phishing email bypassed the existing security controls.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A large organization is restructuring its incident response team. The team currently has a single incident commander who handles all incidents, but the volume of incidents has increased. The CISO wants to improve efficiency and ensure that incidents are handled by the right people. Which team structure is most appropriate?

   • AKeep the single incident commander but add more analysts to the team.
   • BOutsource all incident response to a third-party provider.
   • CCreate a tiered response model with a Level 1 triage team and a Level 2/3 escalation team for complex incidents.
   • DAssign each incident to the first available team member regardless of experience.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A small business has a limited budget for incident response preparation. The owner wants to ensure the business can respond to a cyber incident without hiring full-time security staff. Which preparation activity provides the most value for the limited budget?

   • ADevelop a simple incident response plan, assign roles to existing staff, and conduct a low-cost tabletop exercise.
   • BWait until an incident occurs and then hire a consultant to handle it.
   • CPurchase an expensive commercial incident response retainer from a consulting firm.
   • DInvest in a high-end security information and event management (SIEM) system.
   Reveal Solution Discussion Select an answer first