Incident Reporting GCIL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which communication channel is most appropriate for providing a real-time update to the incident response team during an active incident?

   • AVoicemail
   • BFormal written report
   • CEmail distribution list
   • DDedicated incident chat channel
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An incident responder is documenting a security incident and needs to ensure the documentation is admissible in potential legal proceedings. What is the most important practice to follow?

   • AUse vague language to avoid making definitive statements that could be challenged.
   • BRecord all actions with timestamps and the identity of the person performing each action.
   • CKeep the documentation in a personal notebook to avoid unauthorized access.
   • DDelete any preliminary notes that may contain errors to avoid confusion.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An incident responder is writing the final incident report for a phishing campaign that led to credential compromise. The report will be read by the CISO, the IT help desk manager, and the legal team. The responder has detailed technical logs, a timeline of actions taken, and a list of affected accounts. What is the most important element to include to make the report useful to all three audiences?

   • AA full packet capture of the phishing email headers and the malware hash.
   • BA chronological list of every command run by the incident responder during the investigation.
   • CA recommendation to delete all affected accounts to prevent further compromise.
   • DAn executive summary followed by a technical appendix and a clear impact assessment.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A hospital's IT team detects a phishing email that led to unauthorized access to a single employee's mailbox, which contained no patient data. The security team confirms the mailbox was accessed for 10 minutes before the attacker was locked out. The hospital's incident response plan defines 'major incidents' as those involving patient data or critical system downtime. What is the most appropriate reporting action?

   • AReport the incident to the internal security team and the employee's manager, but not to external regulators.
   • BEscalate to the CEO and board immediately because any unauthorized access is a major incident.
   • CNotify the state health department immediately, as any email compromise is reportable.
   • DNotify all patients whose data might have been in the mailbox, even though none was found.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   During a major incident, the incident commander is concerned about the accuracy of the incident log because multiple team members are entering data. The log is being used to create the final report and for potential legal proceedings. The incident commander has the authority to change the documentation process. What is the most appropriate action to ensure the log's accuracy and integrity?

   • AKeep the log in a shared spreadsheet with no restrictions on editing.
   • BAllow team members to edit their own entries at any time to correct mistakes.
   • CUse a chat channel for all documentation and rely on the chat history as the official log.
   • DImplement a change-control process where entries are reviewed and approved before being added to the log.
   Reveal Solution Discussion Select an answer first