Which stakeholder group should be notified immediately when an incident involves the potential exposure of customer personally identifiable information (PII)?

The general public via social media

Competitors and industry partners

All employees in the organization

A multinational company's security operations center detects a ransomware outbreak that has encrypted files on 200 endpoints in the European headquarters and 15 endpoints in the Asia-Pacific branch. The threat intelligence team has confirmed the ransomware family and has a known decryption tool that works only for the European variant. The CEO has asked for a status update. Which action should the incident commander take FIRST?

Deploy the decryption tool to all affected endpoints immediately to restore operations as quickly as possible.

Isolate the Asia-Pacific branch from the network and continue monitoring the European headquarters for further spread.

Send a preliminary notification to the CEO and await further instructions before taking any action.

Declare a severity-1 incident and activate the full enterprise incident response team, including legal and public relations.

A company is recovering from a significant cyber incident. The incident response team has contained the incident and eradicated the threat. The team is now in the recovery phase and is restoring systems from backups. The incident commander must ensure that the recovery is successful and that the incident does not recur. Which action should the incident commander take during the recovery phase?

Restore systems from known-good backups and verify that they are free of malware before returning them to production.

Skip the recovery phase and move directly to lessons learned to save time.

Restore systems from the most recent backups available to minimize data loss, regardless of their integrity.

Return systems to production immediately after restoring from backups to minimize downtime.

After a significant incident, the incident response team is conducting a lessons-learned review. The team identifies that the lack of a documented communication plan caused delays in notifying key stakeholders. Which action should the team take to address this finding?

Assign a single point of contact for all communications during future incidents.

Conduct additional training for the incident response team on communication best practices.

Create and implement a communication plan that defines roles, escalation paths, and templates for stakeholder notifications.

Document the finding in the incident report and close the incident without further action.

GIAC Enterprise Incident Responder

Domain 1Objective 1

Enterprise Incident Response Management GEIR Practice Questions (Page 2)

Part of the Incident Response Foundations domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 6–10

6foundation · easy
Which stakeholder group should be notified immediately when an incident involves the potential exposure of customer personally identifiable information (PII)?
Select an answer first
7application · medium
A multinational company's security operations center detects a ransomware outbreak that has encrypted files on 200 endpoints in the European headquarters and 15 endpoints in the Asia-Pacific branch. The threat intelligence team has confirmed the ransomware family and has a known decryption tool that works only for the European variant. The CEO has asked for a status update. Which action should the incident commander take FIRST?
Select an answer first
8expert · hard
A company is recovering from a significant cyber incident. The incident response team has contained the incident and eradicated the threat. The team is now in the recovery phase and is restoring systems from backups. The incident commander must ensure that the recovery is successful and that the incident does not recur. Which action should the incident commander take during the recovery phase?
Select an answer first
9foundation · easy
In an enterprise incident response team, which role is specifically tasked with collecting, preserving, and analyzing digital evidence in a forensically sound manner?
Select an answer first
10application · medium
After a significant incident, the incident response team is conducting a lessons-learned review. The team identifies that the lack of a documented communication plan caused delays in notifying key stakeholders. Which action should the team take to address this finding?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Enterprise Incident Response Management GEIR Practice Questions (Page 2)

Questions 6–10

Which stakeholder group should be notified immediately when an incident involves the potential exposure of customer personally identifiable information (PII)?

In an enterprise incident response team, which role is specifically tasked with collecting, preserving, and analyzing digital evidence in a forensically sound manner?

After a significant incident, the incident response team is conducting a lessons-learned review. The team identifies that the lack of a documented communication plan caused delays in notifying key stakeholders. Which action should the team take to address this finding?

Keep studying — Incident Response Foundations