5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary goal of the containment phase in incident response?

   • ATo limit the damage and prevent further spread of the incident
   • BTo document lessons learned
   • CTo restore systems to normal operation
   • DTo identify the root cause of the incident
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   After a phishing incident is contained and eradicated, the incident response team holds a lessons-learned meeting. Which activity is MOST directly associated with the post-incident activity phase?

   • ADeleting all phishing emails from user mailboxes
   • BReviewing firewall logs to identify the phishing email source
   • CResetting the passwords of all affected users
   • DUpdating the phishing playbook based on the team's observations
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security manager is explaining the value of NIST SP 800-61 to the executive team. The executives ask why the organization should adopt this standard instead of relying on its own internal experience. What is the MOST compelling reason to adopt NIST SP 800-61?

   • AIt ensures that all incidents will be resolved without business impact
   • BIt eliminates the need for an incident response policy
   • CIt provides a legally binding framework that guarantees compliance with all regulations
   • DIt offers a structured, widely recognized approach that improves consistency and effectiveness of incident response
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's incident response policy states that only the incident response manager can authorize disconnecting a system. During a fast-spreading worm, a network engineer disconnects a critical server without authorization, which stops the spread but causes a brief outage. The engineer is disciplined. Which assessment of this situation is most accurate?

   • AThe engineer was right because stopping the spread is always more important than policy.
   • BThe engineer violated the policy, but the policy may need review to allow faster decisions during emergencies.
   • CThe engineer was wrong because no one should ever act without authorization.
   • DThe policy should be ignored because it is too restrictive.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which element is essential in an incident response plan to ensure that the right people are notified and can act quickly?

   • AA detailed budget for incident response activities
   • BA communication plan that includes contact information for team members and stakeholders
   • CA description of the organization's marketing strategy
   • DA list of approved security vendors
   Reveal Solution Discussion Select an answer first