Incident Remediation and Closure GCIL Practice Questions (Page 10)

Questions 46–48

1. 46expert · hard

   A company has been responding to a data breach that involved exfiltration of customer data. The incident response team has contained the breach, eradicated the attacker's access, and restored systems. However, the forensic investigation is still ongoing, and the team is unsure if all exfiltration channels have been identified. The business wants to close the incident to reduce legal exposure. What is the most appropriate action?

   • AClose the incident and document that the investigation is ongoing.
   • BKeep the incident open until the forensic investigation is complete and all exfiltration channels are identified.
   • CClose the incident and rely on monitoring to detect any further exfiltration.
   • DClose the incident because the attacker's access has been eradicated.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   During the post-incident review, the team identifies that the incident response plan lacked a clear escalation path for after-hours security alerts. What is the most effective way to capture this finding for improvement?

   • ABlame the on-call analyst for not escalating quickly enough.
   • BDocument the gap in the lessons-learned report and recommend updating the escalation procedure in the incident response plan.
   • CWait until the next incident to see if the problem recurs.
   • DNote the issue in the incident timeline but take no further action.
   Reveal Solution Discussion Select an answer first
3. 48foundation · easy

   Which remediation strategy is primarily focused on restoring affected systems to a known-good state after the threat has been removed?

   • AEradication
   • BContainment
   • CDetection
   • DRecovery
   Reveal Solution Discussion Select an answer first