Incident Reporting GCIL Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a typical component of a post-incident report?

   • AA list of all employees' performance reviews
   • BA list of all software licenses owned by the organization
   • CA detailed timeline of the incident and response actions
   • DA marketing analysis of the organization's brand image
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During a weekend security incident, the on-call incident commander needs to notify the CISO, the general counsel, and the head of customer support about a confirmed data breach. The incident commander has a secure chat channel, email, and phone contact for each. The breach is severe and requires immediate executive awareness, but no customer notifications have been made yet. What is the most appropriate communication approach?

   • ASend a detailed email to all three stakeholders with the full technical analysis and impact assessment.
   • BWait until the next business day to notify stakeholders so the report can be fully polished and accurate.
   • CPost a detailed message in the secure chat channel and assume all stakeholders will see it promptly.
   • DCall each stakeholder to provide a brief verbal summary and then follow up with a written summary via secure email.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of a post-incident report's 'lessons learned' section?

   • ATo capture insights and recommendations for improving future incident response
   • BTo summarize the incident for public relations
   • CTo provide a detailed technical log for auditors
   • DTo identify what went wrong and assign blame
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is an internal stakeholder that should be included in incident reporting?

   • ACustomers
   • BExecutive leadership
   • CLaw enforcement
   • DRegulatory agencies
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   After a major incident, the incident response team is creating the post-incident report. The team has identified several recommendations, but some are costly and require significant investment. The CISO wants the report to be actionable and prioritized. What is the most appropriate way to present the recommendations?

   • AInclude only the recommendations that are low-cost and easy to implement.
   • BList all recommendations in order of importance, with a cost-benefit analysis for each.
   • CPresent the recommendations as a single comprehensive plan without individual cost estimates.
   • DFocus only on the technical recommendations and omit process or people-related improvements.
   Reveal Solution Discussion Select an answer first