What is the primary purpose of NIST SP 800-61 in the context of incident response?

To provide a comprehensive guide for establishing an incident response capability and handling incidents effectively

To mandate specific security controls that must be implemented in every organization

To provide a technical standard for forensic analysis of digital evidence

To define legal requirements for reporting cyber incidents to government authorities

What is the primary role of an incident response policy in an organization?

To define the exact evidence collection techniques for forensic analysis

To establish the authority and framework for incident response activities

To list the specific tools that must be used during an incident

To provide step-by-step technical instructions for handling malware infections

What is the purpose of a lessons-learned meeting after an incident?

To immediately restore all systems without analysis

To delete all evidence related to the incident

To assign blame to individuals who made mistakes

To identify what went well and what could be improved in the incident response process

During the recovery phase, what is the primary objective?

To update the incident response plan

To collect and preserve evidence for legal action

To identify the attackers' identity

To restore affected systems and services to normal operation

CiscoCertified CyberOps Associate

Domain 5Objective 2

5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 12)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

15%of the exam

Questions 56–59

56foundation · easy
What is the primary purpose of NIST SP 800-61 in the context of incident response?
Select an answer first
57foundation · easy
What is the primary role of an incident response policy in an organization?
Select an answer first
58foundation · easy
What is the purpose of a lessons-learned meeting after an incident?
Select an answer first
59foundation · easy
During the recovery phase, what is the primary objective?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.