After a major incident involving a web application breach, the IR team has completed eradication and recovery. The post-incident review is scheduled. The team lead wants to ensure that the lessons learned lead to actual improvements. Which action is most likely to achieve this goal?

Document the timeline of events and distribute it to all stakeholders for their records.

Identify specific weaknesses in the detection and response process and assign owners with deadlines for remediation.

Focus the review on what went well to maintain team morale and avoid blame.

Update the incident response plan to reflect the actual actions taken during the incident.

A financial services company experiences a data breach involving customer personally identifiable information (PII). The company operates in multiple jurisdictions, including the European Union and California. The incident response team has confirmed the breach and is preparing to notify affected customers. Which consideration should the team prioritize when determining the notification timeline?

The team should notify the lead supervisory authority first and then notify customers within 30 days.

The team should wait until the investigation is complete to provide a full and accurate notification to customers.

The team should notify customers as soon as possible, but there is no specific regulatory deadline for notification.

The notification timeline is determined by the most stringent applicable regulation, such as the GDPR's 72-hour requirement or California's notification law.

A retail company detects a POS malware infection that may have captured credit card data from the last 3 weeks. The IR team has confirmed the malware is present on 10 POS terminals. The company's legal counsel advises that this is a reportable breach. What is the MOST urgent priority for the IR team at this point?

Restore the POS terminals from a clean backup to resume sales operations.

Disconnect the POS terminals from the network to stop further data loss.

Notify the payment card brands immediately before any other action.

Preserve forensic evidence from the POS terminals before any remediation steps are taken.

Which legal or regulatory requirement is most likely to affect an enterprise's incident response process when a data breach involves personal data of EU residents?

General Data Protection Regulation (GDPR)

Health Insurance Portability and Accountability Act (HIPAA)

Payment Card Industry Data Security Standard (PCI DSS)

GIAC Enterprise Incident Responder

Domain 1Objective 1

Enterprise Incident Response Management GEIR Practice Questions (Page 6)

Part of the Incident Response Foundations domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 26–30

26application · medium
After a major incident involving a web application breach, the IR team has completed eradication and recovery. The post-incident review is scheduled. The team lead wants to ensure that the lessons learned lead to actual improvements. Which action is most likely to achieve this goal?
Select an answer first
27foundation · easy
During which phase of the incident response lifecycle does the team focus on removing the root cause of the incident from affected systems?
Select an answer first
28application · medium
A financial services company experiences a data breach involving customer personally identifiable information (PII). The company operates in multiple jurisdictions, including the European Union and California. The incident response team has confirmed the breach and is preparing to notify affected customers. Which consideration should the team prioritize when determining the notification timeline?
Select an answer first
29application · medium
A retail company detects a POS malware infection that may have captured credit card data from the last 3 weeks. The IR team has confirmed the malware is present on 10 POS terminals. The company's legal counsel advises that this is a reportable breach. What is the MOST urgent priority for the IR team at this point?
Select an answer first
30foundation · easy
Which legal or regulatory requirement is most likely to affect an enterprise's incident response process when a data breach involves personal data of EU residents?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Enterprise Incident Response Management GEIR Practice Questions (Page 6)

Questions 26–30

After a major incident involving a web application breach, the IR team has completed eradication and recovery. The post-incident review is scheduled. The team lead wants to ensure that the lessons learned lead to actual improvements. Which action is most likely to achieve this goal?

During which phase of the incident response lifecycle does the team focus on removing the root cause of the incident from affected systems?

Which legal or regulatory requirement is most likely to affect an enterprise's incident response process when a data breach involves personal data of EU residents?

Keep studying — Incident Response Foundations