Incident Tracking GCIL Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   An incident response team is using a ticketing system that allows any analyst to change the status of any ticket. During a major incident, an analyst accidentally moves a ticket from 'containment' back to 'detection', causing confusion and duplicated work. The team wants to prevent this while maintaining flexibility. Which control should be implemented?

   • ADisable status changes after the incident is closed
   • BAllow only the incident commander to change statuses
   • CRestrict status transitions to a defined workflow with role-based permissions
   • DRequire a comment for every status change
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which statement best describes the role of incident tracking in managing incidents throughout their lifecycle?

   • AIt provides a centralized record that enables consistent monitoring, communication, and decision-making at each phase
   • BIt is used only during the detection phase to identify potential incidents
   • CIt is a one-time documentation step performed after the incident is closed
   • DIt focuses exclusively on technical data and excludes human actions
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   How does incident tracking facilitate communication among incident response team members?

   • ABy automatically sending emails to all employees
   • BBy restricting access to information to only the incident commander
   • CBy replacing the need for any verbal communication
   • DBy providing a shared record of actions and decisions that all members can reference
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security manager wants to use incident tracking data to justify a new security control. The data shows that a specific type of incident occurs frequently and has a high average cost. However, the data is incomplete for several incidents, and the manager is concerned about the accuracy of the cost estimates. What is the best way to use the data to support the business case?

   • AUse only the incidents with complete data and present them as the full picture
   • BDelay the business case until all data is complete
   • CExclude all incidents with incomplete data to ensure accuracy
   • DPresent the trend with clear caveats about data limitations and supplement with qualitative evidence
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security team is designing its incident tracking data model. They need to support both operational tracking and post-incident trend analysis. The team is considering whether to log every analyst action as a separate entry or to log only major milestones. Which approach best balances operational detail with analytical usability?

   • ALog only major milestones to reduce data volume
   • BLog actions only after the incident is closed
   • CLog every action with structured fields for timestamp, actor, action type, and related incident
   • DLog actions in free-text notes without structured fields
   Reveal Solution Discussion Select an answer first