Incident Reporting GCIL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During a major incident, the incident commander notices that some team members are updating the incident timeline in a shared spreadsheet, while others are sending updates via email and chat. The commander wants to ensure that the final incident report is accurate and defensible. What is the most important action to take?

   • AAssign one person to interview all team members after the incident to reconstruct the timeline.
   • BCollect all email and chat messages at the end of the incident and compile them into a report.
   • CEstablish a single authoritative incident log and require all team members to record actions and observations there.
   • DRely on the incident commander's memory to write the final report.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   According to common incident management practices, which type of incident typically requires the most immediate reporting to executive leadership?

   • AA high-severity incident that is actively impacting critical business operations
   • BA medium-severity incident that is contained but may require additional resources
   • CA low-severity incident that is contained and has no business impact
   • DAny incident that is reported by an external party, regardless of severity
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which section of an incident report is most useful for an executive who needs a quick understanding of the incident's business impact?

   • ATimeline of events
   • BTechnical details section
   • CExecutive summary
   • DRaw log data
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A manufacturing company's OT network has been hit with a wiper malware that is disrupting production lines. The incident commander needs to brief the CEO and board members, who are not technical, within the next hour. The technical team has detailed indicators of compromise and a timeline of the attack. What is the most appropriate communication format for this initial briefing?

   • AA verbal update with no written materials, to avoid sharing sensitive information in writing.
   • BA full technical incident report with all IOCs and the complete attack timeline.
   • CA one-page executive summary with impact on production, estimated recovery time, and key decisions needed.
   • DA detailed slide deck with every indicator and forensic screenshot.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a best practice for record-keeping during an incident?

   • ARecord only the final outcome, not the steps taken
   • BRecord only the technical details, not the decisions
   • CRecord all actions, decisions, and observations in a chronological log
   • DRecord information only after the incident is resolved
   Reveal Solution Discussion Select an answer first