Incident Reporting GCIL Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company that processes credit card payments discovers a breach that may have exposed cardholder data. The company's legal team is assessing whether the breach is reportable under PCI DSS and state law. The company has 30 days to complete the PCI DSS forensic investigation, but the state law requires notification to affected customers within 45 days of discovery. The forensic investigation is expected to take longer than 30 days. What is the most appropriate approach?

   • AComplete the PCI DSS forensic investigation first, then notify customers based on the findings.
   • BAsk the state attorney general for an extension of the 45-day deadline because the PCI DSS investigation is ongoing.
   • CBegin the PCI DSS forensic investigation immediately and prepare customer notifications in parallel to meet the 45-day deadline.
   • DNotify customers immediately with preliminary information and delay the PCI DSS investigation.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   After a significant security incident, the incident response team is preparing the post-incident report. The team has a detailed timeline, technical findings, and a list of actions taken. The CISO wants the report to focus on preventing similar incidents. What is the most important section to include in the report?

   • AA copy of all communication logs between the incident response team and external parties.
   • BA section on root cause analysis and actionable recommendations for improvement.
   • CA summary of the incident commander's performance and team member evaluations.
   • DA detailed list of every system that was compromised and the exact malware hash.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   After a major incident, the incident commander is preparing the post-incident report. The team identified several contributing factors, including a lack of network segmentation and a delayed detection. The CEO wants the report to focus on the response team's performance, while the CISO wants to highlight systemic weaknesses. Which approach best serves the purpose of lessons learned?

   • ADocument both the response team's actions and the systemic weaknesses, with recommendations for each.
   • BFocus only on the response team's performance, to avoid blaming the organization.
   • CWrite two separate reports: one for the CEO and one for the CISO.
   • DFocus only on the systemic weaknesses, since the response team's performance is not relevant.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of incident reporting in cyber incident management?

   • ATo provide timely, accurate information to stakeholders for decision-making and response coordination
   • BTo assign blame for the incident and document failures
   • CTo create a permanent record for legal proceedings
   • DTo satisfy external auditors and regulators only
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   After a major incident, the incident commander is leading a lessons-learned meeting. The team identifies that the detection was delayed because the SIEM alerts were not tuned. What is the most effective way to capture this lesson for improvement?

   • ADocument the root cause and assign an action item to tune the SIEM rules with a target completion date.
   • BNote the issue in the report but do not assign ownership, to avoid blame.
   • CInclude the lesson in the executive summary but not in the technical appendix.
   • DRecommend replacing the SIEM with a new product.
   Reveal Solution Discussion Select an answer first