A SaaS provider that serves customers in the EU and the US discovers a breach that may involve personal data of EU residents. The DPO asks whether the company must notify the supervisory authority. Which factor is most important in determining the notification requirement?

Whether the company has a designated representative in the EU.

Whether the company's data processing agreement with customers requires notification.

Whether the breach is likely to result in a risk to the rights and freedoms of individuals.

Whether the breach was caused by an external attacker or an internal error.

Why is accurate documentation important during an incident?

To fill time during the incident

To provide a basis for legal defense and regulatory compliance

To create a marketing opportunity

To assign blame to specific individuals

For a formal post-incident report intended for senior management, which format is most appropriate?

A detailed written document with an executive summary

A verbal update in a hallway conversation

A healthcare provider discovers that an employee's laptop, containing unencrypted patient records, was stolen from a car. The provider's legal counsel confirms that the state breach notification law requires notification to affected individuals if there is a 'reasonable likelihood of misuse.' The laptop was password-protected but not encrypted. What is the most appropriate reporting action?

Notify affected individuals because the data was unencrypted and there is a reasonable likelihood of misuse.

Notify the police but not the affected individuals.

Wait to see if the laptop is recovered before notifying anyone.

Do not notify anyone because the laptop was password-protected.

A startup company has just experienced its first security incident: a brute-force attack on a single employee's VPN account that was successfully blocked by multi-factor authentication. The CEO asks the security lead what should be reported and to whom. Which response is most appropriate?

Report it to the state attorney general because it is a cyber incident.

Do not report it because the attack was unsuccessful.

Report it to all employees as a security awareness message.

Document the incident internally, report it to the security team, and determine if any external reporting is required.

GIAC Cyber Incident Leader

Domain 5Objective 2

Incident Reporting GCIL Practice Questions (Page 4)

Part of the Communication and Reporting domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 16–20

16application · medium
A SaaS provider that serves customers in the EU and the US discovers a breach that may involve personal data of EU residents. The DPO asks whether the company must notify the supervisory authority. Which factor is most important in determining the notification requirement?
Select an answer first
17foundation · easy
Why is accurate documentation important during an incident?
Select an answer first
18foundation · easy
For a formal post-incident report intended for senior management, which format is most appropriate?
Select an answer first
19application · medium
A healthcare provider discovers that an employee's laptop, containing unencrypted patient records, was stolen from a car. The provider's legal counsel confirms that the state breach notification law requires notification to affected individuals if there is a 'reasonable likelihood of misuse.' The laptop was password-protected but not encrypted. What is the most appropriate reporting action?
Select an answer first
20application · medium
A startup company has just experienced its first security incident: a brute-force attack on a single employee's VPN account that was successfully blocked by multi-factor authentication. The CEO asks the security lead what should be reported and to whom. Which response is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.