Incident Reporting GCIL Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company's incident response team is managing a medium-severity incident that is contained but not yet fully remediated. The team needs to provide a status update to the IT director, who is not in the incident command room. The update should include the current status, the impact, and the next steps. Which format is most appropriate?

   • AA concise email with a status summary, impact, and next steps.
   • BA full technical report with all forensic details.
   • CA phone call with no written follow-up.
   • DA post on the company's internal wiki.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's security team discovers a zero-day vulnerability being exploited in the wild that affects their internet-facing web servers. The team has confirmed the exploit is being used against their environment. The CISO wants to inform the IT operations team immediately. Which communication channel is most appropriate for this urgent, actionable alert?

   • AAn email to the entire IT operations team with the technical details.
   • BA post on the company's internal social media channel.
   • CA scheduled weekly security briefing.
   • DA phone call or page to the on-call IT operations manager, followed by a written summary.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A multinational company experiences a data breach that affects customers in the European Union and the United States. The company's legal team is determining the reporting obligations. The breach involves personal data covered by GDPR and state breach notification laws. What is the most appropriate approach to regulatory reporting?

   • AReport the breach only to the EU supervisory authority because GDPR is more stringent.
   • BReport the breach to the relevant EU supervisory authority and the affected US state authorities as required by each regulation.
   • CReport the breach only to the affected customers and not to any regulatory authority.
   • DWait for the legal team to determine the single most appropriate regulatory authority to report to.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a key element of an incident report?

   • AThe personal opinions of the incident responders
   • BThe estimated cost of the response effort
   • CThe names of all employees who were present during the incident
   • DThe timeline of the incident and actions taken
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An incident responder is writing the final report for a complex incident that involved multiple systems and a lengthy investigation. The report will be used by the executive team, the legal department, and the security operations center (SOC) for training. The responder has a large amount of technical data and a detailed timeline. What is the most effective way to structure the report?

   • AWrite a single narrative that combines technical details, legal analysis, and executive summary into one continuous document.
   • BCreate a separate report for each audience and do not share the full report with anyone.
   • CProvide the full technical timeline first, followed by the executive summary, so the reader understands the details before the summary.
   • DStart with an executive summary, then provide a technical appendix for the SOC, and include a legal analysis section.
   Reveal Solution Discussion Select an answer first