Which phase of the NIST SP 800-61 incident response lifecycle includes activities such as lessons learned and reporting?

Containment, Eradication, and Recovery

How do incident response procedures differ from an incident response plan?

Procedures are high-level and strategic, while the plan is detailed and tactical

Procedures are optional, while the plan is mandatory

Procedures are only used after an incident, while the plan is used during an incident

Procedures provide step-by-step guidance for specific tasks, while the plan outlines the overall approach

A company's incident response plan states that during a malware incident, the IT team must isolate affected systems. The plan does not specify how to perform the isolation. The security team wants to ensure consistent execution. What should the team create?

A network diagram showing all connected systems

A new incident response policy that mandates isolation

A lessons-learned report from a previous incident

A detailed procedure that lists the exact commands and steps to isolate a system

A multinational corporation is updating its incident response policy. The policy must comply with data protection regulations in multiple countries, define the scope of the incident response team, and establish a process for post-incident reporting. The legal team insists that the policy include specific compliance requirements for each region. The security team wants the policy to remain flexible. What is the best approach?

Include every regional requirement in the main policy body

Remove all compliance requirements from the policy to keep it flexible

Create a separate policy for each country with no overarching policy

Include a high-level compliance section in the policy and reference detailed regional requirements in an appendix

A security analyst is investigating an alert about a user account that was used to log in from a foreign country at the same time the user was in the office. The analyst checks the SIEM and sees that the login occurred via a VPN. The analyst also notices that the user's account has been used to access files that the user does not normally access. What should the analyst do next?

Ignore the alert because the login was via VPN

Disable the user account immediately

Escalate the alert to the incident response team for immediate containment

Validate the indicator of compromise by correlating the VPN login with the user's travel schedule and access patterns

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 5Objective 4

Describe the Elements of Cybersecurity Incident Response 100-160 Practice Questions (Page 5)

Part of the Incident Handling domain, which makes up ~18% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 21–25

21foundation · easy
Which phase of the NIST SP 800-61 incident response lifecycle includes activities such as lessons learned and reporting?
Select an answer first
22foundation · easy
How do incident response procedures differ from an incident response plan?
Select an answer first
23application · medium
A company's incident response plan states that during a malware incident, the IT team must isolate affected systems. The plan does not specify how to perform the isolation. The security team wants to ensure consistent execution. What should the team create?
Select an answer first
24expert · medium
A multinational corporation is updating its incident response policy. The policy must comply with data protection regulations in multiple countries, define the scope of the incident response team, and establish a process for post-incident reporting. The legal team insists that the policy include specific compliance requirements for each region. The security team wants the policy to remain flexible. What is the best approach?
Select an answer first
25expert · medium
A security analyst is investigating an alert about a user account that was used to log in from a foreign country at the same time the user was in the office. The analyst checks the SIEM and sees that the login occurred via a VPN. The analyst also notices that the user's account has been used to access files that the user does not normally access. What should the analyst do next?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Describe the Elements of Cybersecurity Incident Response 100-160 Practice Questions (Page 5)

Questions 21–25

Which phase of the NIST SP 800-61 incident response lifecycle includes activities such as lessons learned and reporting?

How do incident response procedures differ from an incident response plan?

A company's incident response plan states that during a malware incident, the IT team must isolate affected systems. The plan does not specify how to perform the isolation. The security team wants to ensure consistent execution. What should the team create?

Keep studying — Incident Handling