A company's incident response plan has not been updated in two years. A recent tabletop exercise revealed that the plan does not reflect the company's new cloud-based infrastructure, and the team is unsure how to respond to a cloud-specific incident. The company has limited resources and cannot conduct a full review immediately. What is the most appropriate approach?

Wait until the next annual review to update the plan

Replace the entire plan with a generic cloud incident response template

Prioritize updating the plan to include cloud-specific procedures and validate them with a targeted tabletop exercise

Conduct a full-scale drill to identify all gaps at once

An organization is planning a simulation exercise for its incident response team. The exercise controller wants to ensure that the exercise is evaluated effectively. Which action is most important for a successful evaluation?

Focus only on the final outcome and ignore the process

Conduct the exercise without a facilitator to ensure unbiased results

Keep the scenario secret from all participants, including the evaluators

Define measurable exercise objectives and collect observations against them during the exercise

What is the primary purpose of documenting an incident during the response activities?

To replace the need for an incident response plan

To increase the length of the incident report

To provide a chronological record of actions and findings

GIAC Critical Infrastructure Protection (GCIP)

Domain 4Objective 2

Incident Reporting and Response Planning GCIP Practice Questions (Page 3)

Part of the Change, Vulnerability, and Incident Management domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 11–15

11foundation · easy
Which testing method is the most realistic and involves the deployment of actual personnel, equipment, and procedures in a live environment?
Select an answer first
12expert · hard
A company's incident response plan has not been updated in two years. A recent tabletop exercise revealed that the plan does not reflect the company's new cloud-based infrastructure, and the team is unsure how to respond to a cloud-specific incident. The company has limited resources and cannot conduct a full review immediately. What is the most appropriate approach?
Select an answer first
13application · medium
An organization is planning a simulation exercise for its incident response team. The exercise controller wants to ensure that the exercise is evaluated effectively. Which action is most important for a successful evaluation?
Select an answer first
14foundation · easy
Which incident response testing method involves a discussion-based session where participants walk through a hypothetical scenario without actually executing technical actions?
Select an answer first
15foundation · easy
What is the primary purpose of documenting an incident during the response activities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.

Incident Reporting and Response Planning GCIP Practice Questions (Page 3)

Questions 11–15

Which testing method is the most realistic and involves the deployment of actual personnel, equipment, and procedures in a live environment?

An organization is planning a simulation exercise for its incident response team. The exercise controller wants to ensure that the exercise is evaluated effectively. Which action is most important for a successful evaluation?

Which incident response testing method involves a discussion-based session where participants walk through a hypothetical scenario without actually executing technical actions?

What is the primary purpose of documenting an incident during the response activities?

Keep studying — Change, Vulnerability, and Incident Management