5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which phase of incident handling involves identifying that an incident has occurred and determining its scope?

   • APreparation
   • BPost-Incident Activity
   • CDetection and Analysis
   • DContainment, Eradication, and Recovery
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which data source is commonly used to detect and analyze potential security incidents?

   • AFirewall and intrusion detection system logs
   • BEmployee performance reviews
   • CMarketing campaign analytics
   • DCompany financial reports
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A malware infection is confirmed on a single user workstation. The workstation is not critical to business operations. According to NIST SP 800-61, which containment strategy is most appropriate for this situation?

   • AWait until business hours to disconnect the workstation.
   • BDisconnect the workstation from the network immediately.
   • CRebuild the workstation without disconnecting it from the network.
   • DLeave the workstation connected to monitor the attacker's activity.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After a phishing incident is contained and eradicated, the incident response team holds a meeting to discuss what went well and what could be improved. They also update the playbook for phishing response. Which phase of incident handling does this represent?

   • ADetection and analysis
   • BContainment, eradication, and recovery
   • CPreparation
   • DPost-incident activity
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A small company is building its incident response capability. Management wants to ensure that the team has clear authority to act during an incident and that response activities are consistent across different types of incidents. Which element should be established FIRST?

   • AA list of forensic tools to be used during investigations
   • BAn incident response policy approved by management
   • CA communication plan with external contacts
   • DA detailed playbook for each possible incident type
   Reveal Solution Discussion Select an answer first