A small credit union is developing an IR plan. The plan must comply with state data breach notification laws and the payment card industry (PCI) requirements. The credit union has a small IT team and relies on a managed service provider (MSP) for some services. Which consideration is most important when tailoring the plan?

Use the MSP's incident response plan as the credit union's plan without modification.

Define the roles and responsibilities of both internal staff and the MSP, including notification duties.

Focus only on PCI requirements because they are more stringent than state laws.

Avoid including the MSP in the plan to keep the process simple.

Which of the following should be included in an incident report after the response is complete?

The personal opinions of the responders

Only the names of the attackers

A list of all employees' salaries

Root cause analysis and lessons learned

A university's incident response team conducts a post-incident review after a phishing attack that compromised several faculty accounts. The review reveals that the team did not have a clear procedure for revoking access for compromised accounts. What is the most appropriate follow-up action?

Purchase a new identity management tool to automate account revocation

Retrain the IT staff on general account management best practices

Document the gap in the after-action report but do not change the plan until the next annual review

Add a detailed account-revocation procedure to the incident response plan and schedule a targeted exercise to test it

After a tabletop exercise, a financial firm's incident response team identifies that the communication plan did not specify who contacts the external legal counsel. The team also notices that the exercise scenario was too easy and did not stress the decision-making process. What should the team do next?

Repeat the same exercise until the team performs flawlessly

Replace the tabletop exercise with a full-scale drill next time

Document the findings but do not change the plan because the exercise was only a test

Update the plan to assign the legal notification responsibility and design a more challenging next exercise

GIAC Critical Infrastructure Protection (GCIP)

Domain 4Objective 2

Incident Reporting and Response Planning GCIP Practice Questions (Page 5)

Part of the Change, Vulnerability, and Incident Management domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 21–25

21application · medium
A small credit union is developing an IR plan. The plan must comply with state data breach notification laws and the payment card industry (PCI) requirements. The credit union has a small IT team and relies on a managed service provider (MSP) for some services. Which consideration is most important when tailoring the plan?
Select an answer first
22foundation · easy
Which of the following is an internal stakeholder that should be notified during a significant incident?
Select an answer first
23foundation · easy
Which of the following should be included in an incident report after the response is complete?
Select an answer first
24application · medium
A university's incident response team conducts a post-incident review after a phishing attack that compromised several faculty accounts. The review reveals that the team did not have a clear procedure for revoking access for compromised accounts. What is the most appropriate follow-up action?
Select an answer first
25application · medium
After a tabletop exercise, a financial firm's incident response team identifies that the communication plan did not specify who contacts the external legal counsel. The team also notices that the exercise scenario was too easy and did not stress the decision-making process. What should the team do next?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.

Incident Reporting and Response Planning GCIP Practice Questions (Page 5)

Questions 21–25

Which of the following is an internal stakeholder that should be notified during a significant incident?

Which of the following should be included in an incident report after the response is complete?

A university's incident response team conducts a post-incident review after a phishing attack that compromised several faculty accounts. The review reveals that the team did not have a clear procedure for revoking access for compromised accounts. What is the most appropriate follow-up action?

Keep studying — Change, Vulnerability, and Incident Management