5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   When should law enforcement be contacted during an incident?

   • AOnly after the incident is fully resolved and all evidence is deleted
   • BFor every minor security incident, regardless of impact
   • COnly if the incident involves a physical break-in
   • DWhen the incident may involve criminal activity and legal action is being considered
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SOC analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious file transfer to an external IP address. To confirm whether this is a true incident, which action is MOST appropriate?

   • ANotify the external organization that owns the IP address
   • BCorrelate the file transfer with other logs and indicators
   • CErase the logs to prevent further exposure
   • DImmediately block the external IP address
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   How do procedures differ from an incident response plan?

   • AProcedures are optional if the plan is well-written
   • BProcedures are only used for external communication
   • CProcedures are more detailed and specific than the plan
   • DProcedures are less detailed than the plan
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company's incident response team is unsure whether they have the authority to disconnect a critical business system during a suspected breach. Which document should provide this authority and define the framework for response actions?

   • AFirewall change request form
   • BVendor support contract
   • CNetwork topology diagram
   • DIncident response policy
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which statement best describes the relationship between an incident response policy and an incident response plan?

   • AThe policy is only needed for external reporting, while the plan is for internal use
   • BThe plan is optional if the policy is comprehensive
   • CThe policy provides the high-level direction, while the plan provides the specific actions to be taken
   • DThe plan is the same as the policy, just with more detail
   Reveal Solution Discussion Select an answer first