What is the purpose of conducting a post-incident review?

To calculate the exact cost of the incident

To identify what went well and what can be improved

An organization is planning a tabletop exercise to test its IR plan. The exercise will involve a scenario where a phishing email leads to unauthorized access to a critical system. Which element is most important to include in the exercise design?

A realistic scenario that is relevant to the organization's threat profile and that allows participants to make decisions.

A highly technical scenario that only the IT team can understand.

A scenario that has a predetermined 'correct' outcome that participants must guess.

A scenario that is identical to the previous exercise to allow comparison.

What is the primary purpose of designing a realistic scenario for an incident response exercise?

To ensure all participants fail

To make the exercise challenging for participants

To test the plan against a plausible and relevant threat

To reduce the time needed for the exercise

After an incident response exercise, what is the primary purpose of analyzing the results?

To determine the cost of the exercise

To celebrate the success of the team

To identify gaps and areas for improvement

A nuclear power plant's IR plan has never been tested. The regulator requires a full-scale exercise every two years, but the plant's safety committee is concerned that a full-scale drill could interfere with safety systems. The plant has a budget for only one exercise this year. What is the best course of action?

Conduct a functional exercise that tests only the communication systems, not the full response.

Postpone the full-scale drill until the next year and conduct a simulation this year.

Conduct only a tabletop exercise and document that a full-scale drill was not feasible.

Conduct a full-scale drill that is carefully planned to avoid impacting safety systems, and include a tabletop exercise as a warm-up.

GIAC Critical Infrastructure Protection (GCIP)

Domain 4Objective 2

Incident Reporting and Response Planning GCIP Practice Questions (Page 2)

Part of the Change, Vulnerability, and Incident Management domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 6–10

6foundation · easy
What is the purpose of conducting a post-incident review?
Select an answer first
7application · medium
An organization is planning a tabletop exercise to test its IR plan. The exercise will involve a scenario where a phishing email leads to unauthorized access to a critical system. Which element is most important to include in the exercise design?
Select an answer first
8foundation · easy
What is the primary purpose of designing a realistic scenario for an incident response exercise?
Select an answer first
9foundation · easy
After an incident response exercise, what is the primary purpose of analyzing the results?
Select an answer first
10expert · hard
A nuclear power plant's IR plan has never been tested. The regulator requires a full-scale exercise every two years, but the plant's safety committee is concerned that a full-scale drill could interfere with safety systems. The plant has a budget for only one exercise this year. What is the best course of action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.