Incident Preparation GCIL Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An organization's incident response plan has not been updated in two years. During a recent incident, the team discovered that the plan referenced outdated contact information and did not include a newly adopted cloud service. What is the best way to maintain the plan going forward?

   • AAssign a single person to update the plan whenever they have time.
   • BUpdate the plan only after an incident occurs.
   • CCreate a new plan from scratch every year.
   • DEstablish a scheduled review cycle and update the plan whenever significant changes occur, such as new systems or personnel changes.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A newly formed incident response team is developing its first incident response plan. The team has limited experience and is unsure about the scope of the plan. The CISO wants the plan to be comprehensive but also practical and maintainable. Which approach is most appropriate for developing the plan?

   • AUse a template from another organization without modification.
   • BStart with a high-level framework that defines roles, communication, and escalation, then add detailed procedures for the most likely incident types.
   • CWrite a detailed plan that covers every possible incident scenario in depth.
   • DFocus only on technical procedures and leave out roles and communication.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A hospital's incident response team is being restructured. The team currently has a single incident commander who is also the IT director. During a recent ransomware attack, the IT director was overwhelmed trying to manage both the technical response and the communication with hospital leadership. The incident leader is tasked with improving the team structure. Which change is most effective?

   • ASeparate the incident commander role from the IT director role and create a dedicated communications lead to handle stakeholder updates.
   • BKeep the current structure but provide the IT director with a mobile phone to improve communication.
   • CAssign the communications role to the hospital's public relations department, which is not part of the incident response team.
   • DEliminate the incident commander role and have the entire team make decisions by consensus.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An organization's incident response plan includes a detailed communication tree that lists specific individuals by name. Several of these individuals have left the company, and the plan has not been updated. During a recent incident, responders wasted time trying to contact former employees. What is the most effective way to prevent this in the future?

   • ASend an email to all employees asking them to update their contact information in the plan.
   • BRemove the communication tree from the plan entirely and rely on the incident commander to know who to contact.
   • CReplace the named individuals in the communication tree with role-based titles and establish a process to review and update the plan quarterly.
   • DUpdate the communication tree with the names of the new employees who replaced the departed ones.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company is updating its incident response plan. The plan currently defines the incident response team as a single group with no clear sub-teams. The company has grown and now has a dedicated security operations center (SOC), a threat intelligence team, and a communications team. The CISO wants to integrate these teams into the incident response plan. Which approach is most effective?

   • AKeep the plan as a single-team structure and have the SOC handle all incidents.
   • BAssign the threat intelligence team to handle all incident response activities.
   • CCreate a separate plan for each team and do not integrate them.
   • DUpdate the plan to define specific roles for each team, including a SOC lead, threat intelligence lead, and communications lead, and establish clear escalation paths.
   Reveal Solution Discussion Select an answer first