Incident Tracking GCIL Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is maintaining documentation from incident tracking data important for compliance?

   • AIt replaces the need for legal counsel
   • BIt provides evidence that incidents were handled according to policy
   • CIt is required by all data protection laws worldwide
   • DIt guarantees that the organization will pass any audit
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An incident response team is managing multiple concurrent incidents. The incident commander wants to quickly identify which incidents are at risk of missing their resolution targets. Which tracking feature should be used?

   • AA list of all incidents sorted by severity
   • BA weekly email report of closed incidents
   • CA chat channel where analysts post updates
   • DA dashboard showing incidents with overdue or soon-to-due SLAs
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an example of a tool commonly used for incident tracking?

   • AA backup solution that stores copies of data
   • BAn intrusion detection system that generates alerts
   • CA ticketing system that records incident details and updates
   • DA network firewall that blocks malicious traffic
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security manager needs to present a quarterly summary of incident response performance to executives. The summary must include the number of incidents, average time to contain, and the most common incident types. What is the best source for this data?

   • AThe security team's email archive
   • BInterviews with each incident responder
   • CThe organization's firewall logs
   • DThe incident tracking system's reporting dashboard
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A distributed incident response team uses a ticketing system as the primary communication channel. During a fast-moving incident, team members are also using a chat application for real-time discussions. The incident commander wants to ensure that decisions made in chat are not lost. What is the best practice?

   • ARequire that any decision made in chat be summarized and posted as a comment on the incident ticket
   • BTrust team members to remember decisions and record them later
   • CExport the chat log and attach it to the ticket at the end of the incident
   • DDisable chat and require all communication to occur in the ticketing system
   Reveal Solution Discussion Select an answer first