Incident Tracking GCIL Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization wants to reduce the number of repeat incidents caused by the same misconfiguration. The incident tracking system contains historical data. Which analysis would best identify the recurring root cause?

   • ASearch incident records for common root cause tags and correlate with configuration changes
   • BCount the total number of incidents per month
   • CReview only the most recent incident's details
   • DAsk the team to recall past incidents
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During a security incident, the incident response team is using a ticketing system to track actions. The team lead wants to ensure that every action taken by team members is logged with enough context to reconstruct the timeline later. Which set of fields should be mandatory in the ticket update form to meet this requirement?

   • ATimestamp, priority, and ticket status
   • BAffected asset, timestamp, and resolution notes
   • CActor, action description, and next steps
   • DTimestamp, actor, action description, and affected asset
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After a major incident, the board of directors requests a report summarizing the incident's impact and response effectiveness. The incident tracking system contains detailed logs. What is the best way to produce this report?

   • AWrite a narrative from memory of the incident
   • BGenerate an executive summary report from the tracking data, highlighting key metrics and outcomes
   • CAsk each team member to write their own summary
   • DProvide the raw incident logs to the board
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During an incident, the network team and the endpoint team are working on different aspects. The incident commander wants to ensure that both teams are aware of each other's actions to avoid conflicts. What is the most effective way to achieve this using the incident tracking system?

   • AHave each team maintain a separate ticket and merge them at the end
   • BLet the teams coordinate through their own managers
   • CSend a daily status email to both teams
   • DRequire both teams to update the same incident ticket with their actions and review each other's updates
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An incident response team is using a ticketing system that requires manual status updates. During a major incident, team members are so focused on technical work that they forget to update the ticket. The incident commander loses visibility and cannot report progress to executives. What is the most effective solution that balances tracking accuracy with response speed?

   • AStop updating the ticket until the incident is over
   • BAssign a dedicated scribe to update the ticket in real time
   • CRequire team members to update the ticket every 15 minutes
   • DIntegrate the ticketing system with the tools the team already uses, such as chat and automation, to automatically update status based on actions
   Reveal Solution Discussion Select an answer first