Incident Reporting and Response Planning GCIP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which component of an incident response plan outlines the steps to detect, contain, eradicate, and recover from an incident?

   • ACommunication protocols
   • BEscalation matrix
   • CProcedures
   • DRoles and responsibilities
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An energy company is planning a full-scale IR drill that will involve simulated loss of the control system. The exercise will include multiple departments and external agencies. What is the most important factor to address during the planning phase?

   • AKeep the exercise a secret from most participants to test their spontaneous reactions.
   • BSelect a scenario that is highly complex and includes every possible attack vector.
   • CEnsure that the exercise is conducted without any external observers to avoid distractions.
   • DCoordinate with all participants to ensure they understand the exercise's scope, safety rules, and their specific roles.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A hospital's IR team has a new incident response plan but has never tested it. The compliance officer wants to validate the plan's communication protocols and decision-making chains without disrupting clinical operations. The team has limited time and budget. Which testing method is most appropriate?

   • AConduct a tabletop exercise with key stakeholders walking through a ransomware scenario in a facilitated discussion.
   • BRun a full-scale drill that simulates a ransomware attack on the hospital's production network.
   • CReview the plan document in a meeting without any scenario or role-playing.
   • DPerform a functional exercise that tests the technical containment procedures in a live environment.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A mid-sized manufacturing company is developing its first incident response plan. The company operates in a jurisdiction that requires breach notification to a data protection authority within 72 hours. The plan must also align with the company's limited IT staff and existing communication tools. Which approach best meets these needs?

   • AOutsource the entire incident response function to a third-party provider and rely on their plan.
   • BCreate a plan that assigns the same person to all key roles to minimize headcount.
   • CDevelop a plan that defines roles using existing staff, uses current email and phone for communication, and includes a 72-hour notification procedure.
   • DAdopt a generic IR plan template from the internet without modification.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   After a full-scale drill, the evaluators report that the IR team performed well technically, but the public relations (PR) department was not included in the exercise, and the CEO was not notified until the drill was nearly over. The IR plan does not specify PR involvement or CEO notification triggers. What is the most important improvement to make?

   • ADocument the findings and move on, since the technical response was successful.
   • BBlame the exercise planners for not including PR and the CEO in the scenario.
   • CUpdate the IR plan to include PR as a key stakeholder and define clear triggers for CEO notification.
   • DConduct another full-scale drill that includes PR and the CEO to test the new procedures.
   Reveal Solution Discussion Select an answer first