5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   After a significant data breach, the incident response team completes containment, eradication, and recovery. The organization's legal counsel advises that the incident may lead to litigation. The team is preparing for the post-incident activity phase. Which action is MOST important to take during this phase?

   • APreserve all evidence and maintain a chain of custody
   • BImmediately update all security policies based on lessons learned
   • CReturn all systems to normal operation as quickly as possible
   • DDelete all temporary files created during the investigation
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company's web server is compromised and is being used to host malware. The incident response team needs to contain the incident, but the server also hosts a customer-facing application that generates significant revenue. The team has a backup server that can take over the application's function. What is the BEST containment strategy?

   • ARemove the malware from the server while it remains online
   • BShut down the server and do not provide the application until the investigation is complete
   • CKeep the server online to avoid disrupting customers
   • DDisconnect the compromised server and switch traffic to the backup server
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's incident response team discovers a breach that involves customer data. The team needs to notify affected customers, but the legal department has not yet determined the regulatory requirements. Which action is most aligned with NIST SP 800-61 guidance?

   • ANotify customers immediately without legal review to be transparent.
   • BWait for the incident to be fully resolved before notifying anyone.
   • CFollow the pre-approved communication plan that includes legal review before external notifications.
   • DLet the media announce the breach first to control the narrative.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of a playbook in incident response?

   • ATo list the contact information of all incident response team members
   • BTo provide step-by-step guidance for handling a specific type of incident
   • CTo define the overall incident response policy of the organization
   • DTo record the results of post-incident reviews
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is typically included in an incident response communication plan?

   • AContact information for internal and external stakeholders
   • BThe organization's financial statements
   • CA list of all security vulnerabilities in the organization
   • DThe technical specifications of the incident response tools
   Reveal Solution Discussion Select an answer first