During a data breach, the incident response team needs to notify the organization's customers, the media, and law enforcement. The team is unsure who is authorized to speak to each party. Which element of the incident response plan should have been defined in advance to prevent this confusion?

A set of containment strategies for different incident types.

A list of forensic tools approved for evidence collection.

A communication plan that designates spokespersons and approval chains for each audience.

A chain-of-custody form for tracking evidence.

A company experiences a data breach involving customer personal information. The incident response team has confirmed the breach and is about to begin containment. According to the communication plan, which party should be notified FIRST?

The organization's legal counsel

The incident response team and executive management

A company suffers a breach that may involve criminal activity. The incident response team wants to coordinate with law enforcement, but the legal department is concerned about sharing sensitive data. The team also wants to share indicators with an ISAC. Which approach best balances these concerns?

Coordinate with law enforcement through legal counsel and share sanitized indicators with the ISAC.

Refuse to share any information with law enforcement to protect the company.

Share all data with law enforcement and the ISAC immediately to speed up the investigation.

Only share information with the ISAC and avoid law enforcement entirely.

An organization's incident response team is responding to a malware outbreak. They have identified the infected hosts, isolated them, and removed the malware. They are now verifying that the systems are clean and restoring them to normal operation. Which phase of the incident handling process are they in?

Containment, Eradication, and Recovery

According to NIST SP 800-61, which of the following is the correct sequence of the four phases of incident handling?

Post-Incident Activity, Preparation, Detection and Analysis, Containment/Eradication/Recovery

Detection and Analysis, Preparation, Containment/Eradication/Recovery, Post-Incident Activity

Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity

Preparation, Containment/Eradication/Recovery, Detection and Analysis, Post-Incident Activity

CiscoCertified CyberOps Associate

Domain 5Objective 2

5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 11)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

15%of the exam

Questions 51–55

51application · medium
During a data breach, the incident response team needs to notify the organization's customers, the media, and law enforcement. The team is unsure who is authorized to speak to each party. Which element of the incident response plan should have been defined in advance to prevent this confusion?
Select an answer first
52application · medium
A company experiences a data breach involving customer personal information. The incident response team has confirmed the breach and is about to begin containment. According to the communication plan, which party should be notified FIRST?
Select an answer first
53expert · hard
A company suffers a breach that may involve criminal activity. The incident response team wants to coordinate with law enforcement, but the legal department is concerned about sharing sensitive data. The team also wants to share indicators with an ISAC. Which approach best balances these concerns?
Select an answer first
54application · medium
An organization's incident response team is responding to a malware outbreak. They have identified the infected hosts, isolated them, and removed the malware. They are now verifying that the systems are clean and restoring them to normal operation. Which phase of the incident handling process are they in?
Select an answer first
55foundation · easy
According to NIST SP 800-61, which of the following is the correct sequence of the four phases of incident handling?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.