Incident Tracking GCIL Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a post-incident review, your team discovers that the timeline of attacker actions is incomplete because several key actions were only recorded in an analyst's personal notes. The incident commander wants to ensure that future incidents produce a complete, defensible record. Which data collection practice should be standardized?

   • AStore personal notes in a shared folder after the incident is closed
   • BRequire analysts to record all actions in the incident ticket with timestamps and actor identification
   • CAsk analysts to email their personal notes to the incident commander at the end of each shift
   • DCollect only automated system logs and disregard manual actions
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An incident response team is distributed across multiple time zones. The incident commander needs to ensure that all team members have a consistent understanding of the incident status at all times. The team uses a ticketing system, but some members rely on email updates. What is the best approach to maintain a single source of truth?

   • AAllow team members to choose their preferred communication method
   • BUse a shared document for status updates
   • CEstablish a policy that the ticketing system is the authoritative source and all status changes must be made there, with email notifications generated from the system
   • DSend a daily summary email to all team members
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An organization notices that a specific type of incident consistently takes much longer to resolve than others. The tracking data shows that these incidents often stall in the 'Analysis' stage. The team wants to reduce the resolution time. What is the most effective action based on the tracking data?

   • AIncrease the priority of all incidents of this type
   • BInvestigate why the 'Analysis' stage is slow for this incident type and implement targeted improvements, such as pre-defined analysis checklists or additional training
   • CClose these incidents faster without completing analysis
   • DAssign more responders to every incident of this type
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   During a cross-functional incident, the technical team is using the incident tracking system, but the public relations (PR) team is not included. The PR team needs timely updates to prepare external communications, but they do not need access to sensitive technical details. The incident commander must balance information sharing with confidentiality. What is the best approach?

   • ACreate a separate PR-specific view in the tracking system with approved summaries and key milestones
   • BSend PR a daily email summary from the incident commander
   • CGive PR full access to the incident ticket
   • DExclude PR from all incident tracking and brief them only at the end
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a major incident, the incident commander notices that multiple teams are working on the same tasks without coordination, leading to duplicated effort. The commander wants to use the incident tracking system to improve coordination. Which practice should be implemented?

   • AAssign each task to a specific owner in the tracking system and update status as work progresses
   • BKeep task assignments in a separate chat thread
   • CWait for the incident commander to assign tasks verbally
   • DAllow all team members to edit all tasks freely
   Reveal Solution Discussion Select an answer first