A SOC team is investigating a potential incident. The team has identified a suspicious process on a server, but the process is also used by a legitimate business application. The team must decide whether to escalate the incident. What is the MOST important factor in this decision?

The process name and its similarity to known malware

The time of day the process was first observed

The context of the process activity, including network connections and behavior

The number of alerts generated by the process

A small company is creating its incident response plan. They have limited staff and want to ensure that during an incident, someone is always available to handle initial triage. Which preparation activity is most effective?

Purchase an expensive SIEM tool to automate all detection.

Define a rotation schedule and train multiple team members on triage procedures.

Wait until an incident occurs to assign roles.

Assign all incident response duties to the most senior engineer.

A company discovers a breach involving customer data. The incident response team is preparing to notify affected parties. The company's legal counsel states that regulatory notification must occur within 72 hours. However, the investigation is not complete and the full scope of the breach is unknown. What is the BEST course of action?

Notify regulators with the available information and provide updates as the investigation continues

Ask the ISAC to notify regulators on the company's behalf

Wait until the investigation is complete to provide accurate information

Notify only the affected customers and not the regulators

Which stakeholder is most likely to be responsible for communicating with external regulatory bodies during an incident?

Legal counsel or compliance officer

Public relations or corporate communications

CiscoCertified CyberOps Associate

Domain 5Objective 2

5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 5)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

15%of the exam

Questions 21–25

21expert · hard
A SOC team is investigating a potential incident. The team has identified a suspicious process on a server, but the process is also used by a legitimate business application. The team must decide whether to escalate the incident. What is the MOST important factor in this decision?
Select an answer first
22application · medium
A small company is creating its incident response plan. They have limited staff and want to ensure that during an incident, someone is always available to handle initial triage. Which preparation activity is most effective?
Select an answer first
23expert · hard
A company discovers a breach involving customer data. The incident response team is preparing to notify affected parties. The company's legal counsel states that regulatory notification must occur within 72 hours. However, the investigation is not complete and the full scope of the breach is unknown. What is the BEST course of action?
Select an answer first
24foundation · easy
Which document is the primary NIST publication that provides guidance on incident handling for federal agencies and other organizations?
Select an answer first
25foundation · easy
Which stakeholder is most likely to be responsible for communicating with external regulatory bodies during an incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 5)

Questions 21–25

A SOC team is investigating a potential incident. The team has identified a suspicious process on a server, but the process is also used by a legitimate business application. The team must decide whether to escalate the incident. What is the MOST important factor in this decision?

A small company is creating its incident response plan. They have limited staff and want to ensure that during an incident, someone is always available to handle initial triage. Which preparation activity is most effective?

Which document is the primary NIST publication that provides guidance on incident handling for federal agencies and other organizations?

Which stakeholder is most likely to be responsible for communicating with external regulatory bodies during an incident?

Keep studying — 5.0 Security Policies and Procedures