During a long-running incident, the incident commander notices that some team members are not logging their actions in the incident management system because they are too busy. The commander is concerned that the final report will be incomplete. Which action is most effective in ensuring accurate documentation without hindering the response?

Rely on the incident commander to document everything after the incident.

Require all team members to log their actions at the end of each shift.

Assign a dedicated scribe to record actions and decisions in real time.

Use automated tools to capture all actions without human input.

A hospital experiences a ransomware attack that affects patient records and clinical systems. The incident response team has confirmed the attack and is working to restore services. The hospital's legal counsel notes that the attack may be reportable under HIPAA and state law. The CEO wants to avoid panic among patients and staff. The incident response team has limited resources and must prioritize reporting. What is the most appropriate approach?

Notify patients and staff first to maintain trust, then report to regulators when convenient.

Prioritize reporting to HHS and state authorities to meet legal deadlines, then notify patients and staff with a coordinated message.

Delay all reporting until the hospital's systems are fully restored to provide a complete picture.

Report only to the FBI and let them handle all other notifications.

A global company with headquarters in the US and a subsidiary in Germany discovers a breach that affects personal data of both US and EU residents. The company's legal team is debating whether to notify the German supervisory authority. The breach involves a misconfigured database that was publicly accessible for 48 hours. No evidence shows the data was actually accessed. Which factor is most critical in deciding whether to notify the German supervisory authority?

Whether the US headquarters has a data processing agreement with the German subsidiary.

Whether the database was accessible from the EU.

Whether the company has a legal entity in Germany.

Whether the breach poses a risk to the rights and freedoms of the affected EU individuals.

After a security incident, the incident response team is conducting a lessons-learned review. The team has identified several areas for improvement, including faster detection and better communication. What is the most appropriate way to capture these lessons for future incidents?

Include the lessons only in the executive summary of the report.

Wait for the next incident to see if the same issues occur before documenting anything.

Create a post-incident report with a section on lessons learned and actionable recommendations.

Discuss the lessons in a team meeting but do not document them to avoid formalizing mistakes.

A global company is responding to a data breach that affects customers in multiple countries. The incident response team must provide updates to the executive board, the legal team, and the IT operations team. The board expects a high-level summary, legal needs detailed regulatory analysis, and IT needs technical indicators of compromise. The team has limited time to prepare updates. What is the most appropriate communication strategy?

Send the technical indicators to the board and the executive summary to IT to save time.

Create a single comprehensive report that includes all details and distribute it to all stakeholders.

Use a single email to all stakeholders with the executive summary and attach the full technical report.

Prepare three separate updates tailored to the needs of each audience, using appropriate channels for each.

GIAC Cyber Incident Leader

Domain 5Objective 2

Incident Reporting GCIL Practice Questions (Page 6)

Part of the Communication and Reporting domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 26–30

26expert · hard
During a long-running incident, the incident commander notices that some team members are not logging their actions in the incident management system because they are too busy. The commander is concerned that the final report will be incomplete. Which action is most effective in ensuring accurate documentation without hindering the response?
Select an answer first
27expert · hard
A hospital experiences a ransomware attack that affects patient records and clinical systems. The incident response team has confirmed the attack and is working to restore services. The hospital's legal counsel notes that the attack may be reportable under HIPAA and state law. The CEO wants to avoid panic among patients and staff. The incident response team has limited resources and must prioritize reporting. What is the most appropriate approach?
Select an answer first
28expert · hard
A global company with headquarters in the US and a subsidiary in Germany discovers a breach that affects personal data of both US and EU residents. The company's legal team is debating whether to notify the German supervisory authority. The breach involves a misconfigured database that was publicly accessible for 48 hours. No evidence shows the data was actually accessed. Which factor is most critical in deciding whether to notify the German supervisory authority?
Select an answer first
29application · medium
After a security incident, the incident response team is conducting a lessons-learned review. The team has identified several areas for improvement, including faster detection and better communication. What is the most appropriate way to capture these lessons for future incidents?
Select an answer first
30expert · hard
A global company is responding to a data breach that affects customers in multiple countries. The incident response team must provide updates to the executive board, the legal team, and the IT operations team. The board expects a high-level summary, legal needs detailed regulatory analysis, and IT needs technical indicators of compromise. The team has limited time to prepare updates. What is the most appropriate communication strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Incident Reporting GCIL Practice Questions (Page 6)

Questions 26–30

After a security incident, the incident response team is conducting a lessons-learned review. The team has identified several areas for improvement, including faster detection and better communication. What is the most appropriate way to capture these lessons for future incidents?

Keep studying — Communication and Reporting