A company is developing a new mobile application that stores user data on the device and syncs to a cloud backend. The threat model must consider both the device and the cloud. Which approach would best identify and prioritize threats across the entire system?

Wait until the app is developed and then run a penetration test.

Focus only on the cloud backend because it stores the most data.

Use a threat modeling framework designed only for mobile apps.

Create a data flow diagram covering the mobile app, the cloud backend, and the sync process, then apply STRIDE to each component.

A regional bank's vulnerability management team completed a quarterly authenticated scan of its internet-facing web application tier. The scanner reported 1,200 findings, of which 340 are rated High or Critical by CVSS. The bank has a 30-day remediation SLA for High findings and a 14-day SLA for Critical findings. The team has capacity to remediate approximately 150 findings per month across all severities. The CISO has asked for a defensible plan that meets compliance obligations while managing the team's workload. Which approach should the incident leader recommend?

Extend the SLA for all findings to 60 days to match the team's remediation capacity and avoid any missed deadlines.

Focus exclusively on internet-facing systems and defer all internal findings to the next quarterly scan cycle.

Prioritize remediation based on a combined score of CVSS severity, asset business criticality, and current threat intelligence indicating active exploitation in the wild.

Remediate all Critical findings first, then High findings, working strictly in CVSS score order within each severity band until the SLAs are met.

After a vulnerability assessment, the security team needs to report findings to the executive leadership. The executives are not technical and need to understand the business impact and required decisions. What is the most effective way to communicate the findings?

Present a summary that highlights the top risks in business terms, with recommended actions and resource needs.

Provide the full technical scan report with all CVSS scores and exploit details.

Explain each vulnerability in technical terms and ask the executives to choose which to fix.

Send a list of all vulnerabilities sorted by severity.

A security team is preparing to scan a mixed environment of Windows servers and Linux workstations. The team needs to identify missing patches and common misconfigurations without disrupting production services. Which approach best satisfies these requirements?

Run an authenticated vulnerability scan with credentials for both Windows and Linux systems during a maintenance window.

Use a passive network monitoring tool to observe traffic and infer vulnerabilities from observed protocols.

Run an unauthenticated network scan from the internet to identify externally visible weaknesses.

Deploy an agent on each system to continuously report installed software versions and configuration settings.

How does integrating threat intelligence into vulnerability management help an organization?

It automatically patches all identified vulnerabilities

It provides context about which vulnerabilities are actively exploited in the wild

It eliminates the need for human analysis of vulnerabilities

It replaces the need for vulnerability scanning

GIAC Cyber Incident Leader

Domain 2Objective 3

Vulnerability and Threat Management GCIL Practice Questions (Page 8)

Part of the Incident Preparation and Prevention domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 36–40

36expert · hard
A company is developing a new mobile application that stores user data on the device and syncs to a cloud backend. The threat model must consider both the device and the cloud. Which approach would best identify and prioritize threats across the entire system?
Select an answer first
37application · medium
A regional bank's vulnerability management team completed a quarterly authenticated scan of its internet-facing web application tier. The scanner reported 1,200 findings, of which 340 are rated High or Critical by CVSS. The bank has a 30-day remediation SLA for High findings and a 14-day SLA for Critical findings. The team has capacity to remediate approximately 150 findings per month across all severities. The CISO has asked for a defensible plan that meets compliance obligations while managing the team's workload. Which approach should the incident leader recommend?
Select an answer first
38application · medium
After a vulnerability assessment, the security team needs to report findings to the executive leadership. The executives are not technical and need to understand the business impact and required decisions. What is the most effective way to communicate the findings?
Select an answer first
39application · medium
A security team is preparing to scan a mixed environment of Windows servers and Linux workstations. The team needs to identify missing patches and common misconfigurations without disrupting production services. Which approach best satisfies these requirements?
Select an answer first
40foundation · easy
How does integrating threat intelligence into vulnerability management help an organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.