Incident Tracking GCIL Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A small organization does not have a formal incident tracking system. During a recent incident, the response team relied on email and phone calls. The post-incident review was difficult because there was no single record of what happened. What is the most important reason to implement an incident tracking system?

   • ATo automatically resolve incidents without human intervention
   • BTo provide a single authoritative record of the incident lifecycle that supports coordination and review
   • CTo replace the need for direct communication among team members
   • DTo guarantee that all incidents are prevented
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of incident tracking in an incident response program?

   • ATo provide a structured record of incident details, actions, and status from detection through closure
   • BTo replace the need for post-incident reviews by providing a final report
   • CTo automatically remediate security incidents without human intervention
   • DTo serve as a legal record that guarantees compliance with all regulations
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security operations center (SOC) is handling a suspected ransomware incident. The incident commander needs to know, at a glance, which hosts have been fully remediated, which are awaiting forensic imaging, and which are still in containment. The team currently updates a shared spreadsheet, but updates are inconsistent and the commander often gets conflicting statuses. What should the team implement to provide the most reliable real-time status visibility?

   • AAn email distribution list where analysts send status updates to the incident commander
   • BA chat channel where analysts post status changes as they occur
   • CA shared spreadsheet with color coding and a mandatory update schedule
   • DA ticketing system with status fields and workflow transitions tied to each host
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   How does incident tracking support the recovery stage of the incident lifecycle?

   • ABy preventing the incident from recurring
   • BBy automatically restoring data from backups without human oversight
   • CBy documenting the steps taken to restore systems and verifying their completion
   • DBy identifying the root cause of the incident
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An incident has been contained, but the incident commander is under pressure from executives to declare the incident resolved and close the ticket. However, the team has not yet completed eradication on several systems, and the tracking system shows those systems still in 'contained' status. The commander must balance executive pressure with the need for a defensible closure. What should the commander do?

   • AKeep the ticket open and clearly document that eradication is pending, while communicating the status to executives
   • BClose the ticket now and reopen it after eradication is complete
   • CMark the incident as 'closed' but add a note that eradication is ongoing
   • DChange the status of the affected systems to 'resolved' to satisfy the executives
   Reveal Solution Discussion Select an answer first