GCIH Post-Incident Reporting & Documentation

Question 1

What is the purpose of post-incident reporting?

Accepted Answer

To document the response and improve future incident handling

Answer

To identify the attacker.

Answer

To assess the damage caused by the attack.

Answer

To communicate with external stakeholders.

Question 2

What should be included in an incident report?

Accepted Answer

A description of the attack and the response taken

Answer

Only the actions taken during the incident.

Answer

The identification of the attacker.

Answer

Confidential information about affected employees.

Question 3

How can post-incident analysis help improve security?

Accepted Answer

By identifying and fixing security gaps

Answer

By assigning blame to the attacker.

Answer

By identifying employees involved in the incident.

Answer

By tracking the attacker’s movements.

Question 4

Why is it important to include a timeline in the incident report?

Accepted Answer

To establish a clear chronology of events

Answer

To show how much time was spent on each activity.

Answer

To point out who was responsible for the incident.

Answer

To highlight the costs incurred during the incident.

Question 5

What role does documentation play in post-incident reporting?

Accepted Answer

It creates a permanent record for future reference

Answer

It provides a way to prevent incidents from occurring.

Answer

It ensures that the incident is handled legally.

Answer

It focuses only on the technical aspects of the attack.

Question 6

How can the incident report be used in legal proceedings?

Accepted Answer

To provide a detailed timeline and actions taken

Answer

To serve as the sole evidence of the attack.

Answer

To accuse specific employees.

Answer

To block the attacker's IP address.

Question 7

What is the importance of involving key stakeholders in post-incident documentation?

Accepted Answer

To gain insights for improving future incident response

Answer

To collect the most accurate information.

Answer

To ensure the report is legally compliant.

Answer

To hide the extent of the incident.

Question 8

How can post-incident documentation support compliance requirements?

Accepted Answer

By documenting compliance with all legal requirements

Answer

By keeping the details confidential.

Answer

By focusing on technical remediation.

Answer

By avoiding reporting to regulators.

Question 9

What is the role of recommendations in post-incident reporting?

Accepted Answer

To guide future security improvements

Answer

To assign blame for the incident.

Answer

To justify the cost of response efforts.

Answer

To suggest penalizing the attacker.