After a ransomware incident, the response team has restored systems from backups and verified that the malware is no longer present. The incident commander wants to close the incident. What is the most important remaining step before formal closure?

Notify all employees that the incident is over and they can ignore future alerts.

Immediately delete all forensic images to free up storage space.

Schedule a lessons-learned meeting for next month without any follow-up actions.

Validate that all restored systems meet the predefined closure criteria, including security patches and monitoring coverage.

A post-incident review of a ransomware attack reveals that the organization's backup strategy was ineffective because backups were stored on the same network segment as the production systems and were also encrypted by the ransomware. The organization wants to improve its backup strategy to prevent this from happening again. What is the most effective improvement to recommend?

Encrypt all backups with a strong encryption algorithm.

Store backups in the cloud using a different cloud provider.

Implement immutable, offline backups that are stored on a separate network segment.

Increase the frequency of backups to reduce the amount of data lost.

A web server was compromised via a vulnerable plugin. The incident response team has removed the malicious files and restored the server from a clean backup. What additional action is essential to prevent reinfection through the same vulnerability?

Re-enable the plugin exactly as it was configured before the incident.

Patch or update the vulnerable plugin to a secure version before returning the server to production.

Increase the server's logging level and monitor for future attacks.

Change the server's IP address to a different subnet.

Which action is essential to validate that closure criteria have been met?

Immediately notifying the public

Deleting all incident-related logs

Disabling all affected accounts permanently

Verifying that all affected systems are clean and operational

A manufacturing company discovers that a workstation in the engineering department is communicating with a known command-and-control (C2) domain. The workstation is not needed for current production and contains proprietary design files. The incident response team wants to limit the impact while preserving forensic evidence. What is the most appropriate immediate containment action?

Block the C2 domain at the firewall and continue monitoring the workstation.

Disconnect the network cable from the workstation and power it off.

Apply the latest security patches to the workstation and reboot it.

Isolate the workstation by disconnecting the network cable while leaving it powered on.

GIAC Cyber Incident Leader

Domain 4Objective 1

Incident Remediation and Closure GCIL Practice Questions (Page 2)

Part of the Incident Response and Remediation domain, which makes up ~6% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~3–5 in this domain), expect 3–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 6–10

6application · medium
After a ransomware incident, the response team has restored systems from backups and verified that the malware is no longer present. The incident commander wants to close the incident. What is the most important remaining step before formal closure?
Select an answer first
7expert · hard
A post-incident review of a ransomware attack reveals that the organization's backup strategy was ineffective because backups were stored on the same network segment as the production systems and were also encrypted by the ransomware. The organization wants to improve its backup strategy to prevent this from happening again. What is the most effective improvement to recommend?
Select an answer first
8application · medium
A web server was compromised via a vulnerable plugin. The incident response team has removed the malicious files and restored the server from a clean backup. What additional action is essential to prevent reinfection through the same vulnerability?
Select an answer first
9foundation · easy
Which action is essential to validate that closure criteria have been met?
Select an answer first
10application · medium
A manufacturing company discovers that a workstation in the engineering department is communicating with a known command-and-control (C2) domain. The workstation is not needed for current production and contains proprietary design files. The incident response team wants to limit the impact while preserving forensic evidence. What is the most appropriate immediate containment action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Incident Remediation and Closure GCIL Practice Questions (Page 2)

Questions 6–10

After a ransomware incident, the response team has restored systems from backups and verified that the malware is no longer present. The incident commander wants to close the incident. What is the most important remaining step before formal closure?

A web server was compromised via a vulnerable plugin. The incident response team has removed the malicious files and restored the server from a clean backup. What additional action is essential to prevent reinfection through the same vulnerability?

Which action is essential to validate that closure criteria have been met?

Keep studying — Incident Response and Remediation