Incident Reporting GCIL Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which of the following is an example of a regulatory requirement that may mandate incident reporting?

   • AThe organization's internal IT policy
   • BThe organization's code of conduct
   • CThe incident response playbook
   • DThe General Data Protection Regulation (GDPR)
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A multinational company's security team detects a data exfiltration incident. The team must notify the CEO, the data protection officer (DPO), and the affected customers. The CEO is traveling and only has access to email. The DPO is in a different time zone and is available by phone. Customers are in multiple countries with different notification laws. Which communication plan best addresses the urgency and the different audiences?

   • ACall the CEO, email the DPO, and notify all customers immediately with the same message.
   • BEmail all stakeholders the same detailed technical report.
   • CEmail the CEO with an executive summary, call the DPO immediately, and begin a legal review of customer notification requirements.
   • DWait until the CEO returns to the office to brief them in person.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the typical consequence of failing to comply with mandatory data breach notification laws?

   • AAutomatic termination of the organization's business license
   • BPotential fines and regulatory sanctions
   • CNo consequence if the organization is not publicly traded
   • DNo consequence if the breach is contained
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which escalation path is most appropriate for a suspected data breach that may involve personally identifiable information (PII)?

   • AReport only to the IT help desk for ticket tracking
   • BWait for the investigation to complete before notifying anyone
   • CNotify only the public relations department
   • DEscalate to the incident response team, legal, and privacy officer immediately
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A small business experiences a phishing attack that compromises one employee's email account. The incident responder has confirmed that no other accounts were affected and no data was exfiltrated. The owner asks for a report. What is the most appropriate scope for the incident report?

   • AA report that only lists the actions taken to reset the account and no other information.
   • BA detailed forensic analysis of the employee's email account, including every message read.
   • CA full report including the executive summary, technical details, impact assessment, and lessons learned.
   • DA one-line email stating that the incident is resolved and no action is needed.
   Reveal Solution Discussion Select an answer first