Incident Remediation and Closure GCIL Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which element should be included in post-incident documentation?

   • AA list of unrelated security projects
   • BThe names of all employees in the organization
   • CPersonal opinions about team members' performance
   • DA detailed timeline of events and actions taken
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company's file server is infected with a worm that spreads through SMB. The server is needed for business operations, but the worm is actively infecting other systems. What is the best remediation strategy?

   • AKeep the server online and run an antivirus scan while users continue working.
   • BRestore the server from a backup taken after the infection began.
   • CDisable SMB on the server but leave it connected to the network.
   • DIsolate the file server from the network, then remove the worm and patch the SMB vulnerability before reconnecting.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   After a major incident, the incident commander must produce a final report that will be shared with senior management and potentially regulators. The report must be accurate but also protect sensitive information. What is the best approach?

   • ACreate a comprehensive report with technical details for internal use, and a separate executive summary with redacted sensitive information for external stakeholders.
   • BDelay the report until all legal issues are resolved, even if it takes months.
   • CShare the full technical report with all stakeholders, including regulators.
   • DProvide only a verbal summary to senior management and no written report.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which containment measure is designed to provide a more permanent control while the organization develops a full remediation plan?

   • AIncident detection
   • BLong-term containment
   • CShort-term containment
   • DPost-incident review
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During the lessons-learned meeting, the team discusses that the intrusion detection system generated too many false positives, causing analysts to miss the real alert. What is the most appropriate improvement to recommend?

   • ATune the intrusion detection system's rules to reduce false positives while maintaining coverage of critical alerts.
   • BDisable the intrusion detection system to avoid false positives.
   • CIncrease the number of alerts sent to analysts to ensure they see everything.
   • DIgnore false positives and rely on manual log review.
   Reveal Solution Discussion Select an answer first