After a ransomware incident, the incident response team has restored systems from backups and confirmed that the ransomware binary has been removed from all endpoints. The business wants to declare the incident closed. What must be done before formally closing the incident?

Document the incident timeline and lessons learned in the final report.

Verify that all restored systems are operational and that no indicators of compromise remain.

Notify law enforcement and regulatory authorities of the incident.

Dispose of all forensic images and logs from the investigation.

What is the primary purpose of post-incident documentation?

To replace the need for a lessons-learned meeting

To provide an accurate record of the incident and actions taken

To serve as legal evidence only

To assign blame for the incident

An organization has just completed the eradication and recovery phase of a data breach. The incident response team is preparing to close the incident. Which of the following is a valid closure criterion?

All affected systems have been restored and verified to be free of malicious activity.

The organization's legal counsel has approved the final report.

The incident response team has held a lessons-learned meeting.

All employees have been notified of the incident.

What is the primary goal of the eradication phase in incident response?

Restore systems to normal operation

Limit the spread of the incident

Remove the root cause of the incident

A company discovers that a laptop containing sensitive customer data was stolen from an employee's car. The laptop was encrypted with full-disk encryption, and the employee's password is not stored on the device. What is the most appropriate remediation strategy?

Track the laptop's location using GPS and attempt to recover it.

Assume the encryption is sufficient and take no further action.

Notify law enforcement and wait for them to recover the laptop.

Remotely wipe the laptop and reset the employee's account credentials.

GIAC Cyber Incident Leader

Domain 4Objective 1

Incident Remediation and Closure GCIL Practice Questions (Page 4)

Part of the Incident Response and Remediation domain, which makes up ~6% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~3–5 in this domain), expect 3–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 16–20

16application · medium
After a ransomware incident, the incident response team has restored systems from backups and confirmed that the ransomware binary has been removed from all endpoints. The business wants to declare the incident closed. What must be done before formally closing the incident?
Select an answer first
17foundation · easy
What is the primary purpose of post-incident documentation?
Select an answer first
18application · medium
An organization has just completed the eradication and recovery phase of a data breach. The incident response team is preparing to close the incident. Which of the following is a valid closure criterion?
Select an answer first
19foundation · easy
What is the primary goal of the eradication phase in incident response?
Select an answer first
20application · medium
A company discovers that a laptop containing sensitive customer data was stolen from an employee's car. The laptop was encrypted with full-disk encryption, and the employee's password is not stored on the device. What is the most appropriate remediation strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.