What is a key benefit of using a tracking system for collaboration during an incident?

It allows team members to see who is working on which task

It stores all communications in a separate system

It prevents team members from communicating directly

It automatically assigns tasks based on skill level

An organization's incident tracking data shows that the average time to contain incidents has increased over the past year, but the number of incidents has remained stable. The team suspects that the increase is due to a change in the incident response process, but they are not sure. What is the most appropriate next step to determine the cause?

Increase the priority of all incidents

Assign more responders to every incident

Immediately revert to the previous incident response process

Analyze the tracking data to identify which lifecycle stage has the longest duration and whether any process changes coincide with the increase

During an incident, a responder performs a system reboot that inadvertently destroys volatile evidence. The incident commander wants to understand why this happened and prevent it in the future. Which tracking data would be most helpful in this review?

The responder's years of experience

The ticket log showing the responder's action, the timestamp, and the approval status for the reboot

The number of open tickets at the time

An organization is migrating from a manual spreadsheet-based incident log to a new ticketing system. The compliance team requires that the new system preserve the original timestamps from the spreadsheet for historical incidents. What is the most important consideration during the migration?

Delete the old spreadsheet after the migration is complete

Ensure that the import process preserves the original timestamps and does not overwrite them with the import time

Assign new ticket numbers to all historical incidents

Only migrate incidents that are less than one year old

GIAC Cyber Incident Leader

Domain 3Objective 2

Incident Tracking GCIL Practice Questions (Page 10)

Part of the Incident Assessment and Tracking domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

8concepts

Questions 46–50

46foundation · easy
What is a key benefit of using a tracking system for collaboration during an incident?
Select an answer first
47expert · hard
An organization's incident tracking data shows that the average time to contain incidents has increased over the past year, but the number of incidents has remained stable. The team suspects that the increase is due to a change in the incident response process, but they are not sure. What is the most appropriate next step to determine the cause?
Select an answer first
48application · medium
During an incident, a responder performs a system reboot that inadvertently destroys volatile evidence. The incident commander wants to understand why this happened and prevent it in the future. Which tracking data would be most helpful in this review?
Select an answer first
49expert · hard
An organization is migrating from a manual spreadsheet-based incident log to a new ticketing system. The compliance team requires that the new system preserve the original timestamps from the spreadsheet for historical incidents. What is the most important consideration during the migration?
Select an answer first
50foundation · easy
During which incident lifecycle stage does tracking primarily help coordinate containment actions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Incident Tracking GCIL Practice Questions (Page 10)

Questions 46–50

What is a key benefit of using a tracking system for collaboration during an incident?

During an incident, a responder performs a system reboot that inadvertently destroys volatile evidence. The incident commander wants to understand why this happened and prevent it in the future. Which tracking data would be most helpful in this review?

An organization is migrating from a manual spreadsheet-based incident log to a new ticketing system. The compliance team requires that the new system preserve the original timestamps from the spreadsheet for historical incidents. What is the most important consideration during the migration?

During which incident lifecycle stage does tracking primarily help coordinate containment actions?

Keep studying — Incident Assessment and Tracking