5.4 Map Elements to These Steps of Analysis Based on the NIST.SP800-61 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   Following a data breach, the CSIRT has completed containment, eradication, and recovery. The incident response manager is now preparing the final report. According to NIST.SP800-61, which element should be included in the report to support future incident response improvements?

   • AThe total cost of the incident to the company
   • BA list of all software versions installed on affected systems
   • CA summary of what happened, what was done, and recommendations for improvement
   • DThe names of employees who were responsible for the breach
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has deployed a new intrusion detection system (IDS) that generates thousands of alerts daily. The security team is overwhelmed and has begun ignoring alerts that appear frequently. According to NIST.SP800-61, which Preparation activity would BEST address this situation?

   • AIncreasing the number of security analysts to review all alerts
   • BDisabling the IDS until the team can catch up on the alert backlog
   • CTuning the IDS to reduce false positives and establishing alert prioritization
   • DCreating a new incident response policy that requires all alerts to be investigated
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A malware infection is spreading across a company's network. The CSIRT has identified the affected systems and is deciding how to contain the incident. One option is to disconnect the infected systems from the network. According to NIST.SP800-61, what is the PRIMARY consideration when choosing this containment strategy?

   • AThe need to notify law enforcement before taking any action
   • BThe number of security analysts available to perform the disconnection
   • CThe impact on business operations and the ability to preserve evidence
   • DThe cost of replacing the infected systems
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is investigating a potential data breach. The analyst has confirmed that a phishing email led to credential theft, but the full scope of the breach is unknown. According to NIST.SP800-61, what should the analyst do during the detection and analysis phase?

   • ADisconnect all user workstations from the network
   • BImmediately begin eradicating the phishing email from all mailboxes
   • CSchedule a lessons-learned meeting with the incident response team
   • DPerform initial analysis to determine the scope and impact of the breach
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   According to NIST SP 800-61, which task is performed during the detection and analysis phase?

   • AValidating alerts to determine if they are true incidents
   • BDeleting malicious files from infected systems
   • CConducting a post-incident review
   • DCreating a new incident response policy
   Reveal Solution Discussion Select an answer first