5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst detects a ransomware outbreak on a file server. The incident response plan calls for isolating affected hosts immediately, but the legal department requires that forensic evidence be preserved. Which action best balances containment with evidence preservation?

   • ACopy the hard drive to a forensic image, then reconnect the server to the network.
   • BDelete the ransomware files and restore from backup immediately.
   • CPower off the affected server immediately to stop further encryption.
   • DDisconnect the server from the network but leave it powered on.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   After a major incident, the incident response team is preparing the post-incident report. The legal department wants to include detailed technical findings, while the public relations team wants to release a summary to the public. The team must satisfy both. Which approach is most appropriate?

   • ARelease the full technical report to the public to ensure transparency.
   • BDelay all reporting until the next fiscal quarter.
   • COnly provide a verbal summary to legal and publish the full report publicly.
   • DCreate two versions of the report: a detailed internal version for legal and a sanitized public summary.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A new incident response manager is reviewing the organization's incident response plan. The manager notices that the plan does not identify who is responsible for making decisions about law enforcement involvement. According to NIST SP 800-61, which element is MISSING from the plan?

   • ARoles and responsibilities
   • BA list of indicators of compromise
   • CA communication plan
   • DA list of forensic tools
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is developing its incident response plan. Management wants to ensure that the plan is actionable and that team members know what to do for different types of incidents. The team has limited time and resources. What is the MOST efficient approach to meet this requirement?

   • ACreate a comprehensive playbook for every possible incident type
   • BWrite a single procedure that covers all incident types
   • CRely on external consultants to handle all incidents
   • DDevelop general procedures and create playbooks for the most likely incident types
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A ransomware attack is spreading across a company's network. The affected systems include a critical database that cannot be offline for more than 15 minutes without causing significant business loss. The incident response team has a choice: isolate the database immediately (which will cause downtime) or leave it online to maintain operations while attempting to stop the spread. Which approach best aligns with NIST SP 800-61 guidance?

   • ATake a forensic image of the database while it is still online, then continue operations.
   • BLeave the database online and focus on eradicating the ransomware from other systems first.
   • CIsolate the database immediately, accepting downtime to prevent further spread.
   • DDisconnect only the non-critical systems and leave the database connected to maintain operations.
   Reveal Solution Discussion Select an answer first