GCIH Post-Incident Reporting & Documentation

Question 1

What is the purpose of post-incident reporting?

Accepted Answer

To document the response and improve future incident handling

Answer

Post-incident reporting serves as a comprehensive record of the entire incident, from detection to resolution. This documentation is vital for learning from the incident, identifying areas for improvement in processes and security controls, and training future incident handlers to enhance overall organizational resilience.

Question 2

What should be included in an incident report?

Accepted Answer

A description of the attack and the response taken

Answer

An incident report must include a clear description of the attack, detailing how it was detected, its scope, impact, and the specific response actions taken. This comprehensive documentation is essential for understanding the event, facilitating post-incident analysis, and improving future incident handling procedures.

Question 3

How can post-incident analysis help improve security?

Accepted Answer

By identifying and fixing security gaps

Answer

Post-incident analysis involves a critical review of the entire incident response process and the security posture that allowed the incident to occur. This review helps identify weaknesses, vulnerabilities, and process failures, leading to targeted improvements in security controls, policies, and overall organizational resilience.

Question 4

Why is it important to include a timeline in the incident report?

Accepted Answer

To establish a clear chronology of events

Answer

Including a timeline in the incident report is crucial for establishing a clear chronology of events. This sequential overview helps stakeholders understand the attack's progression, assess the effectiveness of the response actions, and identify critical decision points throughout the incident lifecycle.

Question 5

What role does documentation play in post-incident reporting?

Accepted Answer

It creates a permanent record for future reference

Answer

Documentation plays a critical role in post-incident reporting by creating a permanent, accurate record of all details, actions, and findings. This record is invaluable for auditing, compliance, training purposes, and serves as a knowledge base for future incident response planning and continuous improvement efforts.

(GCIH) GIAC Experienced Incident Handler Practice Test

(GCIH) GIAC Experienced Incident Handler Practice Test

GCIH Post-Incident Reporting & Documentation