5.3 Apply the Incident Handling Process Such as NIST.SP800-61 to an Event 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   During an incident, which communication practice is most important for the incident response team?

   • AKeeping all incident details confidential from everyone
   • BProviding regular status updates to stakeholders
   • CAvoiding communication until the incident is fully resolved
   • DCommunicating only through social media
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst has confirmed that a workstation is infected with malware that is attempting to exfiltrate data to an external server. The analyst wants to contain the incident. Which action aligns with the Containment phase of NIST SP 800-61?

   • AIsolate the workstation by disconnecting it from the network
   • BRun a full antivirus scan on the workstation
   • CUpdate the incident response plan based on the findings
   • DRebuild the workstation from a clean image
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an essential component of incident handling documentation?

   • AThe personal opinions of the incident responders
   • BThe salary information of the incident response team
   • CMarketing materials for the organization
   • DA timeline of actions taken during the incident
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company has established an incident response team. The team includes a technical lead, a communications lead, and a legal advisor. During a security incident, the communications lead is responsible for which of the following tasks?

   • ADeciding whether to disconnect affected systems from the network
   • BManaging all external and internal communications about the incident
   • CPerforming forensic analysis on affected systems
   • DEnsuring that all evidence is preserved for legal proceedings
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has just resolved a data breach incident. The incident response team is meeting to discuss what went well and what could be improved. The team identifies that the detection phase was delayed because the SIEM alerts were not properly tuned. According to NIST SP 800-61, which activity should the team perform to ensure this improvement is implemented?

   • AUpdate the incident response plan to include a requirement for regular SIEM tuning
   • BRetrain the SIEM administrators on how to use the tool
   • CDelete the incident report to avoid legal liability
   • DReclassify the incident as a non-incident to avoid reporting requirements
   Reveal Solution Discussion Select an answer first