Incident Reporting GCIL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After a data breach, the incident commander must write a post-incident report. The report will be shared with the board, legal counsel, and the technical team. Which structure best serves all three audiences?

   • AExecutive summary, impact assessment, technical timeline, and lessons learned.
   • BA legal memorandum with recommendations for litigation.
   • CA single technical narrative with all forensic details.
   • DA list of all actions taken during the incident, in chronological order.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During a major incident, the incident commander asks the scribe to record all decisions and actions in a shared log. Several team members are updating the log concurrently, and some entries are being overwritten. The incident commander needs an accurate record for the post-incident review. What is the most appropriate action to ensure accurate documentation?

   • ARecord only the final decisions and omit the intermediate actions to avoid confusion.
   • BUse a chat channel for all updates and rely on the chat history as the official record.
   • CAsk each team member to maintain their own log and merge them at the end of the incident.
   • DDesignate a single scribe to record all entries and have team members submit updates through them.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which external stakeholder is most likely to require formal notification in the event of a data breach involving personal data?

   • AThe organization's board of directors
   • BThe organization's insurance provider
   • CThe organization's marketing department
   • DThe data protection authority (DPA)
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company's incident response team is writing a post-incident report after a supply-chain attack. The report will be used by the board, legal counsel, and the engineering team. The legal counsel has requested that the report be protected by attorney-client privilege. The engineering team needs the technical details to fix the vulnerability. What is the best approach to satisfy both needs?

   • ACreate two versions of the report: a privileged executive summary for legal and the board, and a separate technical report for the engineering team.
   • BHave the engineering team write their own report and the legal team write a separate one, with no coordination.
   • CWrite a single report with no legal analysis, to avoid privilege issues.
   • DInclude all technical details in the privileged report and share it with the engineering team under a non-disclosure agreement.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial services firm detects unauthorized access to a database containing customer financial records. The incident response team has confirmed the breach and is assessing the scope. The firm's incident response plan specifies that the CISO must be notified within 1 hour of confirmation, and the board must be notified within 24 hours. The team has just confirmed the breach. What is the most appropriate immediate action?

   • ANotify both the CISO and the board simultaneously via email to save time.
   • BWait until the full scope is assessed before notifying the CISO or the board.
   • CNotify the CISO immediately and the board within the 24-hour window.
   • DNotify the board first because they are the highest-ranking stakeholders.
   Reveal Solution Discussion Select an answer first