During an incident, a legal advisor needs to be kept informed of developments but does not need access to all technical details. The incident commander wants to share updates without overwhelming the advisor. Which approach best uses the tracking system?

Create a separate stakeholder ticket or view with high-level summaries and key decisions

Grant the legal advisor full access to the main incident ticket

Send the legal advisor all email updates from the team

Exclude the legal advisor from all incident tracking

How can incident tracking data be used to identify trends in security incidents?

By comparing incidents to industry benchmarks without historical data

By analyzing patterns in incident types, frequencies, and root causes over time

By deleting old incident records to reduce clutter

By focusing only on the most recent incident

A distributed incident response team is handling a breach that spans multiple time zones. The incident commander needs to ensure that all team members have a shared understanding of what has been done and what remains, without requiring synchronous meetings. Which approach best leverages the incident tracking system?

Send a daily summary email to all team members

Maintain a living incident ticket with current status, completed actions, and next steps

Use a shared document that each member updates at the end of their shift

Hold a daily conference call to review progress

Which action demonstrates effective use of a tracking system to monitor incident progress?

Assigning a single status for the entire incident

Updating the ticket status after each major milestone

Waiting until the incident is closed to update the ticket

Deleting the ticket if the incident is not resolved quickly

What is a key characteristic of an effective incident tracking mechanism?

It stores data in a format that is only accessible to one person

It deletes records once the incident is closed

It automatically resolves incidents without human input

It maintains a chronological record of actions and changes

GIAC Cyber Incident Leader

Domain 3Objective 2

Incident Tracking GCIL Practice Questions (Page 8)

Part of the Incident Assessment and Tracking domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

8concepts

Questions 36–40

36application · medium
During an incident, a legal advisor needs to be kept informed of developments but does not need access to all technical details. The incident commander wants to share updates without overwhelming the advisor. Which approach best uses the tracking system?
Select an answer first
37foundation · easy
How can incident tracking data be used to identify trends in security incidents?
Select an answer first
38application · medium
A distributed incident response team is handling a breach that spans multiple time zones. The incident commander needs to ensure that all team members have a shared understanding of what has been done and what remains, without requiring synchronous meetings. Which approach best leverages the incident tracking system?
Select an answer first
39foundation · easy
Which action demonstrates effective use of a tracking system to monitor incident progress?
Select an answer first
40foundation · easy
What is a key characteristic of an effective incident tracking mechanism?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.