What is the main purpose of the lessons-learned phase in incident response?

To determine the financial cost of the incident

To improve future incident response processes

During containment of a malware outbreak, the incident commander directs the team to isolate affected hosts by disconnecting their network cables. A senior analyst objects, noting that the malware may have already spread to other segments. What should the team do next to improve containment?

Power off all affected hosts immediately to prevent further propagation.

Implement network segmentation at the switch level to block affected VLANs while preserving forensic data.

Proceed with eradication on one host at a time while leaving others connected.

Rely solely on the existing host-based firewall to stop the malware.

A financial services firm detects an attacker who has been moving laterally across the network using stolen credentials. The attacker has accessed several file servers but has not yet exfiltrated data. The firm wants to stop the attack while minimizing business disruption. Which remediation strategy should be prioritized first?

Disconnect the file servers from the network to prevent further access.

Deploy endpoint detection and response (EDR) agents to all endpoints.

Rebuild all file servers from clean backups.

Reset the compromised credentials and enforce multi-factor authentication (MFA) on all accounts.

After a data breach, the response team has eradicated the attacker from the network and restored systems. However, the team is uncertain whether the attacker had access to a particular database. What is the most appropriate action before closing the incident?

Conduct a thorough forensic review of the database access logs to determine if the attacker accessed it, and document the findings.

Notify the database users that the incident is closed and no further action is needed.

Close the incident immediately to avoid further resource expenditure.

Assume the attacker did not access the database because no evidence was found in the initial investigation.

An organization has just closed a major security incident. The incident commander is responsible for producing the post-incident documentation. What is the most important reason to include the lessons learned in the documentation?

To provide a detailed technical analysis of the malware used in the attack.

To assign blame to the individuals who caused the incident.

To satisfy legal requirements for incident reporting.

To identify process improvements that can prevent or mitigate future incidents.

GIAC Cyber Incident Leader

Domain 4Objective 1

Incident Remediation and Closure GCIL Practice Questions (Page 6)

Part of the Incident Response and Remediation domain, which makes up ~6% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~3–5 in this domain), expect 3–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 26–30

26foundation · easy
What is the main purpose of the lessons-learned phase in incident response?
Select an answer first
27application · medium
During containment of a malware outbreak, the incident commander directs the team to isolate affected hosts by disconnecting their network cables. A senior analyst objects, noting that the malware may have already spread to other segments. What should the team do next to improve containment?
Select an answer first
28application · medium
A financial services firm detects an attacker who has been moving laterally across the network using stolen credentials. The attacker has accessed several file servers but has not yet exfiltrated data. The firm wants to stop the attack while minimizing business disruption. Which remediation strategy should be prioritized first?
Select an answer first
29expert · hard
After a data breach, the response team has eradicated the attacker from the network and restored systems. However, the team is uncertain whether the attacker had access to a particular database. What is the most appropriate action before closing the incident?
Select an answer first
30application · medium
An organization has just closed a major security incident. The incident commander is responsible for producing the post-incident documentation. What is the most important reason to include the lessons learned in the documentation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.