A small incident response team currently uses a shared email inbox to track incidents. During a busy week, incidents are missed and statuses are unclear. The team wants a low-cost, structured way to track incidents without introducing a complex enterprise tool. Which mechanism should they adopt?

A wiki page listing incidents and owners

A network share with text files for each incident

A lightweight ticketing system with status fields and assignment

A shared calendar to log incident start and end times

An incident ticket is assigned to a responder, but the responder is out sick and no one else is aware of the assignment. The incident stalls for several hours. What tracking feature would have prevented this delay?

A comment on the ticket stating the assignment

A daily email summary of all open tickets

An automated reassignment or escalation rule when a ticket is not updated within a defined period

A higher priority level on the ticket

An organization's compliance team requires a report of all security incidents from the past quarter, including the timeline of actions taken and the final outcome. The incident tracking system contains all the necessary data. What is the most efficient way to produce this report?

Export the raw database tables and send them to compliance

Manually compile the report from emails and chat logs

Ask each team member to write a summary of their actions

Use the reporting feature of the ticketing system to generate a report from the ticket fields and audit logs

An organization must produce a post-incident report for a client within 48 hours. The incident tracking system contains detailed logs, but the data is inconsistent: some entries lack timestamps, and some actions were recorded in different formats. The report must be accurate and complete. What is the most effective way to produce the report given the time constraint?

Reconstruct the entire timeline from memory and email

Wait for the team to clean up all data before generating the report

Use the tracking system's reporting feature to extract available data and manually fill gaps from other sources

Provide the raw logs to the client without any analysis

Which piece of information is essential to record for effective incident tracking?

The names of all employees in the organization

The personal opinions of team members about the incident

The estimated cost of the incident response

The timestamp of each significant action

GIAC Cyber Incident Leader

Domain 3Objective 2

Incident Tracking GCIL Practice Questions (Page 2)

Part of the Incident Assessment and Tracking domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

8concepts

Questions 6–10

6application · medium
A small incident response team currently uses a shared email inbox to track incidents. During a busy week, incidents are missed and statuses are unclear. The team wants a low-cost, structured way to track incidents without introducing a complex enterprise tool. Which mechanism should they adopt?
Select an answer first
7application · medium
An incident ticket is assigned to a responder, but the responder is out sick and no one else is aware of the assignment. The incident stalls for several hours. What tracking feature would have prevented this delay?
Select an answer first
8application · medium
An organization's compliance team requires a report of all security incidents from the past quarter, including the timeline of actions taken and the final outcome. The incident tracking system contains all the necessary data. What is the most efficient way to produce this report?
Select an answer first
9expert · hard
An organization must produce a post-incident report for a client within 48 hours. The incident tracking system contains detailed logs, but the data is inconsistent: some entries lack timestamps, and some actions were recorded in different formats. The report must be accurate and complete. What is the most effective way to produce the report given the time constraint?
Select an answer first
10foundation · easy
Which piece of information is essential to record for effective incident tracking?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.