A company is building its incident response capability. Management wants to ensure that when a malware outbreak occurs, the team knows exactly which steps to take and who is responsible. Which preparation activity is most directly aligned with NIST SP 800-61 guidance?

Conduct a vulnerability scan of all internet-facing systems.

Develop playbooks for common incident types and assign roles to team members.

Purchase additional firewall licenses to improve network performance.

Schedule annual employee security awareness training.

Why is evidence retention important in post-incident activity?

To free up storage space on servers

To support legal proceedings and further analysis

To ensure that all logs are deleted to protect privacy

To prevent the incident from being reported to authorities

According to NIST SP 800-61, which of the following is a key element that should be included in an incident response plan?

A detailed description of the organization's security architecture

A set of procedures for handling specific types of incidents

A list of all hardware and software inventory

A list of all employees' personal contact information

A company that provides financial services discovers that a threat actor has been exfiltrating customer data for several weeks. The incident response team is considering whether to share information with an Information Sharing and Analysis Center (ISAC). What is the PRIMARY benefit of sharing this information with the ISAC?

It satisfies legal requirements for breach notification

It guarantees that the threat actor will be prosecuted

It helps other organizations in the sector protect against the same threat

It provides the company with legal immunity from lawsuits

Why is regular training and testing important in the preparation phase of incident response?

To ensure that team members are familiar with their roles and can respond effectively

To communicate with external parties about incidents

To collect evidence for legal proceedings

To identify the root cause of past incidents

CiscoCertified CyberOps Associate

Domain 5Objective 2

5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 8)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

15%of the exam

Questions 36–40

36application · medium
A company is building its incident response capability. Management wants to ensure that when a malware outbreak occurs, the team knows exactly which steps to take and who is responsible. Which preparation activity is most directly aligned with NIST SP 800-61 guidance?
Select an answer first
37foundation · easy
Why is evidence retention important in post-incident activity?
Select an answer first
38foundation · easy
According to NIST SP 800-61, which of the following is a key element that should be included in an incident response plan?
Select an answer first
39application · medium
A company that provides financial services discovers that a threat actor has been exfiltrating customer data for several weeks. The incident response team is considering whether to share information with an Information Sharing and Analysis Center (ISAC). What is the PRIMARY benefit of sharing this information with the ISAC?
Select an answer first
40foundation · easy
Why is regular training and testing important in the preparation phase of incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.