A company has just experienced a data breach involving customer personal information. The incident response team has been activated, and the incident commander has been designated. The legal department has been notified. Which action should the communications lead take NEXT?

Begin a technical investigation to determine the root cause of the breach.

Wait for the investigation to be complete before communicating with any external parties.

Coordinate with legal to prepare a statement for external stakeholders, including customers and regulators.

Shut down all affected systems to prevent further data loss.

Which of the following is a key step in the recovery phase of incident response?

Restoring data from verified clean backups

Conducting a post-incident review

Disconnecting the affected system from the network

What is the primary purpose of testing a business continuity plan?

To replace the incident response plan

To ensure all employees are trained on security awareness

To comply with all legal requirements

To validate the effectiveness of the plan and identify gaps

A ransomware incident is affecting multiple departments. The incident commander has been designated. Which communication action is MOST appropriate for the incident commander to take during the response?

Focus solely on technical containment and delegate all communication to the lead investigator.

Instruct all employees to post updates on social media to keep the public informed.

Directly contact law enforcement without consulting legal counsel.

Provide regular status updates to executive management and the communications lead.

GIAC Security Leadership

Domain 3Objective 3

Incident Response and Business Continuity GSLC Practice Questions (Page 8)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

15concepts

15 Concepts in This Objective

Incident Response Lifecycle
Incident Response Team Roles
Incident Classification and Triage
Incident Detection and Reporting
Containment Strategies
Eradication and Recovery
Evidence Handling and Chain of Custody
Communication and Coordination
Post-Incident Review and Lessons Learned
Business Continuity Planning Fundamentals
Business Impact Analysis
Continuity Strategies and Recovery Objectives
Continuity Plan Development and Implementation
Testing and Exercising Continuity Plans
Integration of Incident Response and Business Continuity

Questions 36–40

36application · medium
A company has just experienced a data breach involving customer personal information. The incident response team has been activated, and the incident commander has been designated. The legal department has been notified. Which action should the communications lead take NEXT?
Select an answer first
37foundation · easy
Which type of exercise involves a simulated disruption where participants discuss their roles and decisions without actually implementing recovery procedures?
Select an answer first
38foundation · easy
Which of the following is a key step in the recovery phase of incident response?
Select an answer first
39foundation · easy
What is the primary purpose of testing a business continuity plan?
Select an answer first
40application · medium
A ransomware incident is affecting multiple departments. The incident commander has been designated. Which communication action is MOST appropriate for the incident commander to take during the response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.