Incident Tracking GCIL Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An incident ticket has been in the 'Containment' stage for several hours. The incident commander wants to know if the containment actions are actually progressing. Which tracking data would provide the most direct evidence of progress?

   • AThe list of completed containment actions with timestamps and the actor who performed them
   • BThe ticket priority level
   • CThe name of the incident commander
   • DThe number of comments on the ticket
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   After several incidents, the incident response manager notices that phishing-related incidents take much longer to close than other types. The manager wants to identify the root cause and improve the process. Which use of incident tracking data would best support this analysis?

   • AReview the time spent in each lifecycle stage for phishing incidents to identify bottlenecks
   • BAsk the team to estimate the average time per incident in a meeting
   • CReview only the final closure reports for phishing incidents
   • DCompare the total number of phishing incidents to other incident types
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A post-incident review reveals that the incident tracking data is incomplete: several actions were performed but not logged, and some timestamps are inaccurate. The team wants to improve the quality of tracking data for future incidents. What is the most effective improvement?

   • AImplement mandatory fields and validation rules in the ticketing system to ensure that all actions are logged with accurate timestamps
   • BCreate a new spreadsheet for manual logging
   • CReview the tracking data more frequently during incidents
   • DProvide additional training to team members on the importance of logging
   Reveal Solution Discussion Select an answer first
5. 34expert · hard · select all that apply

   An incident response team is selecting a new incident tracking tool. The team requires the ability to track multiple incidents simultaneously, assign tasks to specific team members, and generate compliance reports. Which of the following tool features are essential to meet these requirements? Select all that apply.

   • AIntegration with social media platforms
   • BTask assignment and ownership fields
   • CBuilt-in reporting and export capabilities
   • DMulti-incident dashboard with filtering and search
   Check answers Discussion Select an answer first
6. 35foundation · easy

   What is the primary benefit of using a tracking system to monitor incident status?

   • AIt eliminates the need for team communication
   • BIt guarantees that incidents are resolved within a fixed time
   • CIt automatically resolves incidents without human intervention
   • DIt provides a real-time view of progress and outstanding tasks
   Reveal Solution Discussion Select an answer first