Incident Tracking GCIL Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   An incident has been contained and eradicated, but the incident commander wants to ensure that all affected systems are verified clean before declaring closure. Which tracking action best supports this requirement?

   • AMark the incident as resolved in the tracking system and move on
   • BArchive all logs and delete the incident ticket
   • CCreate a checklist in the incident ticket for each affected system with verification status
   • DClose the ticket immediately and reopen it if issues arise
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   An incident is in the 'Eradication' stage. The team is ready to move to 'Recovery', but the incident commander is concerned that some eradication steps may not have been fully verified. The tracking system shows that all eradication tasks are marked 'Complete', but there is no evidence of verification. What should the incident commander do?

   • ARequire that each eradication task include a verification step with evidence before allowing the ticket to move to 'Recovery'
   • BAsk the team to verbally confirm that eradication was successful
   • CReopen the entire incident from the beginning
   • DProceed to 'Recovery' because the tasks are marked complete
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   What is a key way that incident tracking data contributes to continuous improvement of incident response?

   • ABy providing input for lessons learned and process adjustments
   • BBy replacing the need for security training
   • CBy automatically updating the incident response plan
   • DBy guaranteeing that similar incidents will not recur
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   Your organization must provide regulators with a report showing every action taken during a data breach response, including who performed each action and when. The incident tracking system was used throughout the incident. What is the most efficient way to produce this report?

   • AReconstruct the timeline from analysts' memory and email threads
   • BProvide the raw system logs without any interpretation
   • CGenerate a report directly from the incident tracking system's audit log
   • DCreate a new spreadsheet and ask each analyst to enter their actions
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   After several incidents, the incident response team notices that the same type of malware keeps appearing on endpoints. The team wants to use the incident tracking data to identify the root cause and prevent recurrence. Which analysis of the tracking data would be most useful?

   • ACompare the ticket statuses at the time of closure
   • BCalculate the average time to contain each incident
   • CReview the common initial access vector and affected assets across the incidents
   • DCount the number of tickets assigned to each team member
   Reveal Solution Discussion Select an answer first