A manufacturing company is designing a tabletop exercise for its incident response team. The facilitator wants the exercise to reveal how the team would actually respond to a ransomware attack, including who makes decisions and how information flows. Which approach is most effective for this objective?

Provide the full scenario in advance and ask participants to submit written responses individually

Present a realistic scenario in stages and ask the team to describe their actions at each decision point

Run the exercise on a live replica of the production network

Focus only on the technical containment steps and skip communication procedures

A healthcare organization's IR plan requires notification to the Department of Health and Human Services (HHS) for breaches affecting more than 500 patients. The organization discovers a breach affecting 600 patients. Which action is most appropriate?

Notify HHS without unreasonable delay and no later than 60 days after discovery, as required by regulation.

Notify HHS only if the breach results in financial harm to the patients.

Notify HHS after the internal investigation is complete, even if that takes more than 60 days.

Notify HHS only if the media reports the breach.

After a tabletop exercise, the facilitator's report notes that the incident commander was unclear about when to escalate the incident to the crisis management team, and that the legal department was not notified until two hours after the incident was declared. Which follow-up action is most effective for improving the IR plan?

Document the findings in the after-action report and archive it without making any changes to the plan.

Schedule another tabletop exercise with the same scenario to see if the team performs better the second time.

Revise the IR plan to include explicit escalation criteria and a notification matrix with timeframes for legal and other stakeholders.

Replace the incident commander with someone who has more crisis management experience.

GIAC Critical Infrastructure Protection (GCIP)

Domain 4Objective 2

Incident Reporting and Response Planning GCIP Practice Questions (Page 10)

Part of the Change, Vulnerability, and Incident Management domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 46–49

46application · medium
A manufacturing company is designing a tabletop exercise for its incident response team. The facilitator wants the exercise to reveal how the team would actually respond to a ransomware attack, including who makes decisions and how information flows. Which approach is most effective for this objective?
Select an answer first
47application · medium
A healthcare organization's IR plan requires notification to the Department of Health and Human Services (HHS) for breaches affecting more than 500 patients. The organization discovers a breach affecting 600 patients. Which action is most appropriate?
Select an answer first
48application · medium
After a tabletop exercise, the facilitator's report notes that the incident commander was unclear about when to escalate the incident to the crisis management team, and that the legal department was not notified until two hours after the incident was declared. Which follow-up action is most effective for improving the IR plan?
Select an answer first
49foundation · easy
Which of the following is a key component of an incident response plan that specifies who does what during an incident?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.

Incident Reporting and Response Planning GCIP Practice Questions (Page 10)

Questions 46–49

A healthcare organization's IR plan requires notification to the Department of Health and Human Services (HHS) for breaches affecting more than 500 patients. The organization discovers a breach affecting 600 patients. Which action is most appropriate?

Which of the following is a key component of an incident response plan that specifies who does what during an incident?

Keep studying — Change, Vulnerability, and Incident Management