5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Why is coordination with an Information Sharing and Analysis Center (ISAC) valuable during incident response?

   • ATo obtain legal representation for the organization
   • BTo purchase security software at discounted prices
   • CTo share threat intelligence and receive early warnings about emerging threats
   • DTo outsource the entire incident response process
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following is a key preparation activity for incident response?

   • ANotifying law enforcement about a potential incident
   • BConducting forensic analysis on compromised systems
   • CRestoring systems from backups
   • DDeveloping and maintaining incident response procedures and tools
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company has a documented procedure for handling malware infections. During a new malware incident, the analyst notices that the procedure does not cover a new variant that disables the antivirus agent. What should the analyst do according to NIST SP 800-61 guidance?

   • AStop the response and wait for the procedure to be updated
   • BFollow the existing procedure as closely as possible and document any deviations
   • CEscalate the incident to law enforcement immediately
   • DIgnore the procedure and handle the incident based on personal experience
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company's incident response plan is being reviewed. The plan includes detailed technical procedures, but it does not define the authority of the incident response team to take actions such as disconnecting systems or contacting external parties. What is the MOST likely consequence of this gap?

   • AThe team may delay critical actions while waiting for approval
   • BThe team will be able to respond quickly because procedures are clear
   • CThe team will automatically escalate all decisions to management
   • DThe team will have all the information needed to respond effectively
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   During an incident, a system administrator discovers a compromised server and begins deleting files to stop the attack. The incident response team later finds that critical evidence was destroyed. Which element of the incident response plan would have prevented this if it had been followed?

   • AClearly defined roles and responsibilities that designate who is authorized to perform eradication.
   • BA network performance baseline.
   • CA list of approved antivirus vendors.
   • DA backup retention schedule.
   Reveal Solution Discussion Select an answer first