Incident Reporting GCIL Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A manufacturing company experiences a ransomware attack that halts production. The incident response team has identified the malware and is working on recovery. The CEO wants to know when production will resume, the plant manager needs to know which systems are safe to restart, and the company's cyber insurance provider requires notification within 48 hours. What is the most appropriate reporting approach?

   • ANotify the insurance provider first, then the CEO, and finally the plant manager.
   • BWait until production is restored before notifying any stakeholders to provide a complete picture.
   • CSend the same detailed technical report to the CEO, plant manager, and insurance provider.
   • DProvide the CEO with a status update, the plant manager with a technical briefing, and the insurance provider with a formal notification.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A regional bank discovers a ransomware infection that has encrypted file shares containing customer PII. The incident response team has isolated the affected systems, but the encryption occurred before containment. The bank's legal counsel confirms that the state's breach notification law requires notification to the attorney general within 72 hours of 'confirmed discovery.' The CISO asks you to determine the most appropriate immediate reporting action.

   • ANotify only the affected customers, since the attorney general notification is the responsibility of the state regulator.
   • BNotify the attorney general immediately, even though the full scope of the breach is not yet known.
   • CNotify law enforcement first, and then the attorney general after the criminal investigation concludes.
   • DWait until the investigation determines exactly which customers were affected, then notify the attorney general.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which component of an incident report provides a detailed account of the systems affected and the indicators of compromise (IOCs)?

   • ARecommendations section
   • BImpact assessment
   • CExecutive summary
   • DTechnical details section
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A financial services firm experiences a breach that affects customer account numbers and transaction history. The firm's legal counsel confirms that the breach is reportable to the state attorney general and possibly to the SEC. The firm's public relations team wants to issue a press release immediately. The CEO wants to wait until the investigation is complete. Which stakeholder should be consulted before any external communication?

   • ALegal counsel, to ensure that the communication does not create liability or violate regulations.
   • BThe SEC, to get approval for the press release.
   • CThe state attorney general, to get permission to communicate.
   • DThe public relations team, to craft the best message.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A publicly traded company experiences a ransomware attack that affects its e-commerce platform, causing a multi-day outage. The incident response team has confirmed that customer credit card data was not exfiltrated. Which stakeholders must be included in the initial incident notification?

   • AThe board of directors, legal counsel, and the SEC, because the outage may affect stock price.
   • BThe customers whose data was not exfiltrated, to reassure them.
   • CThe FBI and the Secret Service, because ransomware is always a federal crime.
   • DOnly the technical team and the CEO, to avoid unnecessary alarm.
   Reveal Solution Discussion Select an answer first