5.4 Map Elements to These Steps of Analysis Based on the NIST.SP800-61 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which action is a preparation activity defined in NIST SP 800-61?

   • AAcquiring incident response tools and resources
   • BEradicating malware from affected hosts
   • CDocumenting the timeline of events
   • DIdentifying the scope of an ongoing incident
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is developing its incident response plan. The plan must comply with a regulatory requirement that all security incidents be reported to a supervisory authority within 72 hours. The company has a small IT team and limited budget. According to NIST.SP800-61, which preparation activity is most critical to ensure compliance?

   • APurchase an expensive SIEM platform to automate alerting
   • BHire a 24/7 managed security service provider
   • CDevelop a detailed containment strategy for every possible incident type
   • DDefine roles and procedures for timely incident detection and reporting
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After a major security incident, the incident response team meets to discuss what went well and what could be improved. They identify that the response plan lacked clear escalation criteria. According to NIST.SP800-61, what should the team do with this finding?

   • ADocument the finding but take no further action
   • BBlame the analyst who missed the escalation
   • CUpdate the incident response plan to include escalation criteria
   • DDelete the incident response plan and create a new one
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has confirmed a data breach involving customer records. The breach is ongoing, and the attacker is actively exfiltrating data. The company's legal team wants to preserve evidence for potential litigation, while the operations team wants to stop the exfiltration immediately. According to NIST.SP800-61, what is the best course of action?

   • ADisconnect the systems and then conduct a full forensic analysis before any containment
   • BIsolate the affected systems to stop exfiltration, while preserving forensic images for evidence
   • CLet the exfiltration continue to gather more evidence
   • DImmediately shut down all affected systems
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which task is performed during the post-incident analysis phase in NIST SP 800-61?

   • AContaining the incident to prevent spread
   • BUpdating the incident response plan based on findings
   • CMonitoring for signs of incidents
   • DRestoring systems to normal operation
   Reveal Solution Discussion Select an answer first