GCIL Exam Training Practice Tests (GIAC Cyber Incident Leader GCIL)]

Question 1

Which of the following should be considered when designing an effective incident response training program?
(Select two.)
Response:

A. Financial reporting training B. Restricting training to only the IT department C. Simulated attack scenarios D. Hands-on exercises using security tools

Correct Answer: C,D

Question 2

An organization recently suffered a cloud-based security breach where an attacker accessed their cloud storage and exfiltrated sensitive data. Further investigation found that no external intrusion occurred, but an internal misconfiguration allowed public access to the storage. What should be the first step in remediation?
Response:

A. Rotate all cloud service credentials and API keys B. Reconfigure storage permissions to restrict access C. Conduct a full forensic investigation to identify the attacker D. Disable all cloud storage access until further notice

Correct Answer: B

Question 3

Which key document outlines an organization's response plan for cybersecurity incidents?
Response:

A. Incident Response Plan (IRP) B. Employee Handbook C. Acceptable Use Policy (AUP) D. Business Continuity Plan (BCP)

Correct Answer: A

Question 4

What is the main purpose of incident reporting in cybersecurity?
Response:

A. To avoid regulatory penalties by keeping incidents private B. To eliminate the need for security monitoring C. To document the incident for future reference and compliance D. To blame employees for security breaches

Correct Answer: C

Question 5

Which of the following indicators suggest that an email is part of a phishing attack?
(Select two.)
Response:

A. The email contains a legitimate company logo B. A mismatched sender address and display name C. Emails from a known contact with an attachment D. Urgent requests for sensitive information

Correct Answer: B,D

Question 6

Your organization recently conducted a vulnerability scan and identified multiple high-risk vulnerabilities in critical systems. What should be your next step?
Response:

A. Publish the vulnerability scan report to the public for transparency B. Ignore the vulnerabilities since no breaches have occurred yet C. Shut down all affected systems immediately without further assessment D. Prioritize and remediate the highest-risk vulnerabilities first

Correct Answer: D

Question 7

Which factors should be considered when assessing the impact of a security incident?
(Select two.)
Response:

A. The time it takes to detect the incident B. The affected systems and data C. The popularity of the impacted organization D. The financial cost of the incident

Correct Answer: B,D

GIAC Cyber Incident Leader GCIL - GCIL Exam Practice Test