5.3 Apply the Incident Handling Process Such as NIST.SP800-61 to an Event 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   According to NIST SP 800-61, which phase of the incident handling lifecycle involves developing policies, establishing response procedures, and preparing tools and resources before an incident occurs?

   • APost-Incident Activity
   • BDetection and Analysis
   • CPreparation
   • DContainment, Eradication, and Recovery
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC analyst receives an alert from the SIEM indicating a high volume of outbound traffic from a single workstation to a known command-and-control domain. The analyst also sees a user report that the workstation is running slowly. According to NIST SP 800-61, which phase of the incident handling lifecycle is the analyst currently in?

   • APreparation
   • BDetection and Analysis
   • CEradication and Recovery
   • DContainment
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   After resolving a security incident, the incident response team holds a meeting to discuss what went well and what could be improved. What is this activity called?

   • AEradication
   • BContainment
   • CDetection
   • DLessons learned
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of documenting lessons learned after an incident?

   • ATo assign blame to individuals involved in the incident
   • BTo improve the incident handling process for future incidents
   • CTo immediately restore all systems without review
   • DTo delete all evidence related to the incident
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company's security team has confirmed that a server is infected with ransomware that is actively encrypting files. The server hosts a critical application that cannot be offline for more than 30 minutes. The team has a recent clean backup. Which containment strategy should the team choose to balance the need to stop the spread and the need to restore service quickly?

   • ADisconnect the server from the network and restore from the clean backup
   • BApply a firewall rule to block outbound traffic from the server but keep it running
   • CTake a forensic image of the server before disconnecting it
   • DLeave the server connected and attempt to remove the ransomware manually
   Reveal Solution Discussion Select an answer first