An organization is designing a full-scale exercise to test its incident response plan. The exercise will involve multiple departments and external agencies. The exercise director is concerned that the exercise could disrupt normal operations. What is the most effective way to mitigate this risk while still achieving a realistic test?

Cancel the full-scale exercise and rely on tabletop exercises only

Limit the exercise to a single department to minimize disruption

Schedule the exercise during a planned maintenance window and use simulated injects to avoid actual system impact

Conduct the exercise without prior notice to any participants

A regional water utility has an incident response plan that lists the IT security manager as the sole incident commander. During a recent ransomware event, the IT security manager was on leave and no deputy was designated. The utility's compliance team later noted that state regulators were not notified within the required 72-hour window. Which plan component should be updated to prevent this from recurring?

Add a detailed network diagram to the plan for quick reference during incidents.

Require all incidents to be reported to the board of directors within 24 hours.

Increase the frequency of full-scale drills to quarterly.

Define a clear chain of command with designated alternates for key roles.

An organization's IR plan was updated after a tabletop exercise revealed that the escalation path was unclear. Six months later, the IR team wants to verify that the updated escalation path works in practice. Which approach is most effective?

Assume the update is correct because it was based on the exercise findings.

Conduct a focused tabletop exercise that specifically tests the escalation path with the relevant stakeholders.

Review the updated plan document to ensure the escalation path is written correctly.

Wait for the next full-scale drill to test the escalation path.

Which of the following must be incorporated into an incident response plan to meet regulatory requirements?

A guarantee that all incidents will be resolved within one hour

The organization's marketing strategy

Mandatory reporting timelines and notification obligations

A list of all employees' personal contact information

When developing an incident response plan, which of the following should be considered first to ensure the plan is tailored to the organization?

Conducting a business impact analysis

Purchasing incident response tools

Writing the final plan document

Selecting the incident response team members

GIAC Critical Infrastructure Protection (GCIP)

Domain 4Objective 2

Incident Reporting and Response Planning GCIP Practice Questions (Page 9)

Part of the Change, Vulnerability, and Incident Management domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 41–45

41expert · hard
An organization is designing a full-scale exercise to test its incident response plan. The exercise will involve multiple departments and external agencies. The exercise director is concerned that the exercise could disrupt normal operations. What is the most effective way to mitigate this risk while still achieving a realistic test?
Select an answer first
42application · medium
A regional water utility has an incident response plan that lists the IT security manager as the sole incident commander. During a recent ransomware event, the IT security manager was on leave and no deputy was designated. The utility's compliance team later noted that state regulators were not notified within the required 72-hour window. Which plan component should be updated to prevent this from recurring?
Select an answer first
43application · medium
An organization's IR plan was updated after a tabletop exercise revealed that the escalation path was unclear. Six months later, the IR team wants to verify that the updated escalation path works in practice. Which approach is most effective?
Select an answer first
44foundation · easy
Which of the following must be incorporated into an incident response plan to meet regulatory requirements?
Select an answer first
45foundation · easy
When developing an incident response plan, which of the following should be considered first to ensure the plan is tailored to the organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.

Incident Reporting and Response Planning GCIP Practice Questions (Page 9)

Questions 41–45

An organization's IR plan was updated after a tabletop exercise revealed that the escalation path was unclear. Six months later, the IR team wants to verify that the updated escalation path works in practice. Which approach is most effective?

Which of the following must be incorporated into an incident response plan to meet regulatory requirements?

When developing an incident response plan, which of the following should be considered first to ensure the plan is tailored to the organization?

Keep studying — Change, Vulnerability, and Incident Management