5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the purpose of an indicator of compromise (IOC) in the detection and analysis phase?

   • ATo define the steps for eradicating malware
   • BTo document the lessons learned from a previous incident
   • CTo provide a list of all authorized users on the network
   • DTo help identify that a system or network may have been compromised
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is creating its incident response plan. Management wants to ensure that the team can respond effectively even if key personnel are unavailable. Which preparation activity is MOST important to address this concern?

   • ACreating a list of external security consultants
   • BDocumenting roles and responsibilities with backups for each role
   • CPurchasing additional forensic software licenses
   • DEstablishing a relationship with a local law enforcement agency
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company detects a sophisticated attack that appears to target multiple organizations in the same industry. The incident response team wants to share threat indicators with other companies while protecting sensitive details about their own network. Which action is most appropriate?

   • AWait until the incident is fully resolved before sharing any information.
   • BPublish full technical details of the attack on a public blog.
   • CShare anonymized indicators with an Information Sharing and Analysis Center (ISAC) for the industry.
   • DShare only with the media to raise public awareness.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst detects a ransomware outbreak on a file server. The incident response plan requires immediate action to stop the spread while preserving evidence for later analysis. The team has not yet identified the initial infection vector. Which action should the analyst take first?

   • ANotify the public relations team before taking any action.
   • BReboot the server to clear the ransomware from memory.
   • CRun a full antivirus scan on the server.
   • DDisconnect the affected server from the network.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Who is typically responsible for leading the technical investigation and coordinating the response actions during an incident?

   • AIncident response team lead
   • BChief executive officer
   • CHuman resources manager
   • DExternal legal counsel
   Reveal Solution Discussion Select an answer first