A city's IT department is updating its IR plan. The plan must clearly define who has the authority to declare an incident, who communicates with the media, and how the city council is notified. Which component of the IR plan is most directly being addressed?

Business continuity and disaster recovery plans.

Forensic evidence collection guidelines.

Technical containment procedures.

Roles, responsibilities, and communication protocols.

A small credit union is developing its first incident response plan. The board requires that the plan address regulatory reporting obligations under state data breach laws and the GLBA. The credit union has limited staff and budget. What is the most appropriate approach to plan development?

Develop a plan that assigns all incident response duties to a single IT administrator

Focus the plan only on technical containment and ignore reporting requirements

Incorporate regulatory requirements into the plan and tailor roles and procedures to the credit union's size and resources

Adopt a generic incident response plan template from the internet without modification

A multinational corporation suffers a data breach that affects customers in multiple jurisdictions. The IR plan requires immediate notification to regulators in some countries and allows up to 72 hours in others. The legal team is concerned about conflicting deadlines. The IR team has limited resources. What is the best approach?

Notify only the regulators in the company's home country and ignore others.

Notify all regulators at the same time, regardless of their individual deadlines.

Prioritize notifications based on the shortest regulatory deadlines while documenting the rationale for any delays in other jurisdictions.

Wait for the legal team to resolve the conflict before sending any notifications.

A company's incident response team is documenting a data breach. The team lead wants to ensure that the documentation is admissible in court. Which practice is most important?

Record the time, date, and identity of each person who performed each action

Delete any documentation that contains errors to keep the record clean

Use a shared spreadsheet that anyone can edit without restrictions

Store all documentation on the compromised system itself

During an active malware incident, a security analyst discovers that the incident response plan requires a written incident report to be filed within 24 hours of detection. The analyst is still containing the malware and does not have full details. What should the analyst do?

File a report that includes only the containment steps already taken

Wait until the investigation is complete and then file a single comprehensive report

Verbally brief the manager and skip the written report until after containment

Provide an initial report with known facts and mark it as preliminary, then update it as the investigation progresses

GIAC Critical Infrastructure Protection (GCIP)

Domain 4Objective 2

Incident Reporting and Response Planning GCIP Practice Questions (Page 6)

Part of the Change, Vulnerability, and Incident Management domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 26–30

26application · medium
A city's IT department is updating its IR plan. The plan must clearly define who has the authority to declare an incident, who communicates with the media, and how the city council is notified. Which component of the IR plan is most directly being addressed?
Select an answer first
27application · medium
A small credit union is developing its first incident response plan. The board requires that the plan address regulatory reporting obligations under state data breach laws and the GLBA. The credit union has limited staff and budget. What is the most appropriate approach to plan development?
Select an answer first
28expert · hard
A multinational corporation suffers a data breach that affects customers in multiple jurisdictions. The IR plan requires immediate notification to regulators in some countries and allows up to 72 hours in others. The legal team is concerned about conflicting deadlines. The IR team has limited resources. What is the best approach?
Select an answer first
29expert · hard
A company's incident response team is documenting a data breach. The team lead wants to ensure that the documentation is admissible in court. Which practice is most important?
Select an answer first
30application · medium
During an active malware incident, a security analyst discovers that the incident response plan requires a written incident report to be filed within 24 hours of detection. The analyst is still containing the malware and does not have full details. What should the analyst do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.