Incident Preparation GCIL Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An organization conducted a phishing simulation and found that 30% of employees clicked on a malicious link. The incident leader wants to reduce this number. Which training and awareness approach is most likely to be effective?

   • AImplement a continuous security awareness program that includes regular phishing simulations, immediate feedback, and targeted training for repeat offenders.
   • BSend a one-time email to all employees warning them about phishing attacks.
   • CPunish employees who click on phishing links by revoking their email access for a week.
   • DDisable all email links and require employees to type URLs manually.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a key preparation activity for incident response?

   • AConducting forensic analysis on compromised systems
   • BRestoring systems from clean backups
   • CDeveloping and maintaining incident response policies and procedures
   • DIsolating affected network segments to prevent spread
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A global organization is restructuring its incident response team. The team currently operates in a single time zone, but the organization now has offices in multiple regions. The CISO wants to ensure that incidents can be responded to 24/7 without overburdening the existing staff. The budget allows for hiring additional staff, but the CISO is concerned about maintaining consistent processes and knowledge sharing across the team. Which team structure best addresses these concerns?

   • AHire additional staff in the existing location and extend their shifts to cover more hours.
   • BOutsource all incident response to a managed security service provider (MSSP).
   • CKeep a single centralized team and require them to be on-call 24/7.
   • DCreate regional incident response teams that follow a common playbook and use a shared knowledge base, with a global coordinator role.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Why is it important to regularly test and update an incident response plan?

   • ATo satisfy regulatory requirements that mandate annual plan updates
   • BTo provide job security for the incident response team
   • CTo ensure the plan remains effective and relevant as the organization and threat landscape evolve
   • DTo ensure that the plan is never changed once it is approved
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company is evaluating its incident response tooling. The current tools are a mix of free and commercial products that have been adopted organically over time. The CISO wants to consolidate the toolset to improve efficiency and reduce costs. However, the team is concerned that consolidating may lose specialized capabilities. Which approach best balances consolidation with maintaining necessary capabilities?

   • AEliminate all free tools and keep only commercial products.
   • BImmediately replace all current tools with a single comprehensive suite.
   • CConduct a gap analysis of current tools against the incident response plan's requirements, then consolidate to a smaller set of tools that cover the critical capabilities.
   • DKeep all current tools and add more tools to cover any gaps.
   Reveal Solution Discussion Select an answer first