5.4 Map Elements to These Steps of Analysis Based on the NIST.SP800-61 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A malware infection has been detected on a critical database server. The server cannot be taken offline because it supports a live production application. According to NIST.SP800-61, which containment strategy is most appropriate in this situation?

   • AIgnore the infection until the next maintenance window
   • BRebuild the server from a clean image right away
   • CApply an interim containment measure, such as blocking the malware's command-and-control traffic at the firewall
   • DDisconnect the server from the network immediately
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security incident was resolved, and the incident response team is writing a report. The report includes a timeline of events, actions taken, and root cause. According to NIST.SP800-61, what additional element should be included in the post-incident report?

   • ARecommendations for improving the incident response process
   • BA detailed cost breakdown of the incident
   • CThe names of all employees involved in the incident
   • DA list of all tools used during the incident
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After a ransomware incident, the CSIRT successfully contained the threat and restored systems from backups. The team is now meeting to discuss what went well and what could be improved. According to NIST.SP800-61, which output is the MOST important to produce from this meeting?

   • AA set of recommendations to update the incident response plan and improve future responses
   • BA list of employees who failed to follow the incident response plan
   • CA detailed timeline of the incident for legal purposes
   • DA press release to inform the public about the incident
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A mid-sized company is building its first incident response capability. The security manager has just received approval to purchase a SIEM platform and endpoint detection tools. The CSIRT team has been assembled, but no formal procedures exist yet. According to NIST.SP800-61, which activity should the team complete FIRST to ensure the new tools and team are effective?

   • ABegin collecting baseline network traffic to establish normal behavior patterns
   • BConduct a tabletop exercise to test the team's response to a simulated breach
   • CDeploy the SIEM and configure alerting rules for known attack patterns
   • DDraft an incident response policy and define escalation procedures
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is about to deploy a new incident response plan. The plan includes roles, escalation procedures, and tool lists. According to NIST.SP800-61, what additional preparation activity should the company perform before an incident occurs?

   • AWait for a real incident to test the plan
   • BTrain the incident response team and conduct a tabletop exercise
   • CDelete the plan after the first review
   • DOnly document the plan and store it in a secure location
   Reveal Solution Discussion Select an answer first