An incident response team is evaluating tools for incident tracking. They need a solution that automatically captures timestamps for every change and allows multiple team members to update the same incident simultaneously. Which type of tool best meets these requirements?

A cloud-based ticketing system with audit logging and concurrent editing

A shared spreadsheet stored on a local file server

A personal notebook kept by the incident commander

A physical whiteboard in the incident command center

What is the primary purpose of generating reports from incident tracking data?

To replace the need for incident documentation

To ensure that all incidents are reported to law enforcement

To automatically fix the root cause of the incident

To provide stakeholders with a summary of incident handling and outcomes

Why is it important to log the actor (person or system) who performed each action during an incident?

To assign blame for the incident

To provide accountability and enable follow-up questions about the action

To satisfy legal requirements in all jurisdictions

To automatically determine the root cause

A team is evaluating whether to use a dedicated incident tracking tool or continue using a general-purpose project management tool. The team needs to track incident-specific fields such as severity, containment status, and attacker indicators. Which consideration is most important?

The tool must integrate with the organization's email system

The tool must be familiar to all team members

The tool must be available on mobile devices

The tool must support custom fields and workflows tailored to incident response

An organization is required to produce a detailed incident timeline for a client. The tracking system contains entries, but some entries lack timestamps and actor names. What should be done to ensure future incidents produce complete timelines?

Accept that timelines will be incomplete

Rely on system logs to fill in the gaps

Ask analysts to add missing information after the incident

Make timestamp and actor fields mandatory in the tracking system

GIAC Cyber Incident Leader

Domain 3Objective 2

Incident Tracking GCIL Practice Questions (Page 3)

Part of the Incident Assessment and Tracking domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

8concepts

Questions 11–15

11application · medium
An incident response team is evaluating tools for incident tracking. They need a solution that automatically captures timestamps for every change and allows multiple team members to update the same incident simultaneously. Which type of tool best meets these requirements?
Select an answer first
12foundation · easy
What is the primary purpose of generating reports from incident tracking data?
Select an answer first
13foundation · easy
Why is it important to log the actor (person or system) who performed each action during an incident?
Select an answer first
14application · medium
A team is evaluating whether to use a dedicated incident tracking tool or continue using a general-purpose project management tool. The team needs to track incident-specific fields such as severity, containment status, and attacker indicators. Which consideration is most important?
Select an answer first
15application · medium
An organization is required to produce a detailed incident timeline for a client. The tracking system contains entries, but some entries lack timestamps and actor names. What should be done to ensure future incidents produce complete timelines?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.