Describe the Elements of Cybersecurity Incident Response 100-160 Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A hospital has an incident response plan that follows the NIST lifecycle. The plan includes a preparation stage with regular training and tool deployment. During a ransomware attack, the team detects the incident, contains it, eradicates the malware, and recovers systems. After recovery, the team conducts a lessons-learned meeting and updates the plan. Which statement best describes the team's adherence to the NIST lifecycle?

   • AThe team should have performed post-incident activity before recovery to improve the response
   • BThe team should have skipped the preparation stage because the incident was already detected
   • CThe team followed the lifecycle correctly by performing preparation, detection, containment, eradication, recovery, and post-incident activity
   • DThe team skipped the detection and analysis stage because they did not document the indicators of compromise
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security operations center receives an alert about a user account attempting to access a sensitive database at 3:00 AM. The analyst reviews the logs and sees that the account has never logged in from that workstation before. What is the analyst doing in this scenario?

   • AConducting lessons learned
   • BContaining the incident
   • CValidating an indicator of compromise
   • DEradicating the threat
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A small manufacturing company wants to improve its ability to respond to cybersecurity incidents. The IT manager has budget for only one initiative this quarter. Which initiative best supports the preparation stage of the NIST incident response lifecycle?

   • ADeploying an endpoint detection and response (EDR) tool on all workstations
   • BWriting and testing an incident response plan and conducting a tabletop exercise
   • CPurchasing additional backup storage and configuring daily backups
   • DHiring a third-party forensic firm to be on retainer
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which activity is part of the post-incident activity stage?

   • ARestoring data from backups
   • BIsolating affected systems from the network
   • CAnalyzing network logs to detect the incident
   • DUpdating the incident response plan based on lessons learned
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is preparing its incident response team for a potential cyber incident. The team has limited budget and needs to prioritize preparation activities. The company's main risk is phishing attacks that lead to credential compromise. Which preparation activity should be prioritized to address this specific risk?

   • APurchase a new SIEM platform
   • BHire additional security analysts
   • CDevelop a detailed incident response plan
   • DConduct regular phishing simulations and train employees to recognize suspicious emails
   Reveal Solution Discussion Select an answer first