5.4 Map Elements to These Steps of Analysis Based on the NIST.SP800-61 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In the NIST SP 800-61 incident response lifecycle, which action is part of the containment, eradication, and recovery phase?

   • AMonitoring for signs of a new incident
   • BIsolating the affected network segment
   • CDocumenting lessons learned
   • DEstablishing an incident response policy
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SOC analyst is investigating a series of alerts about unusual outbound connections from multiple workstations. The alerts are individually low severity, but the analyst notices a pattern: all connections occur at the same time each day and go to the same external IP. The analyst is unsure if this is a coordinated attack or a scheduled update. According to NIST.SP800-61, what is the most appropriate action?

   • AImmediately block the external IP at the firewall
   • BCorrelate the alerts with other logs and threat intelligence to validate whether this is an incident
   • CEscalate the alerts to the CSIRT without further analysis
   • DDocument the alerts in the lessons-learned report
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is building a new SOC. The team has just purchased a SIEM platform and deployed network taps. However, the incident response team has not yet defined roles, escalation paths, or communication procedures. According to NIST.SP800-61, which activity is still missing from the preparation phase?

   • AConducting a post-incident review of past incidents
   • BEstablishing an incident response policy and plan
   • CDeploying additional endpoint detection agents
   • DIsolating affected systems from the network
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A small company is creating its first incident response capability. They have a limited budget and cannot afford a dedicated 24/7 SOC. According to NIST.SP800-61, which preparation activity is most important to perform first?

   • APurchase a next-generation firewall for all network segments
   • BHire a third-party incident response firm on retainer
   • CDefine an incident response policy and form a CSIRT with assigned roles
   • DDevelop a detailed containment strategy for every possible attack
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After a ransomware incident, the affected systems have been cleaned and restored from backups. The systems are back online and appear to be functioning normally. According to NIST.SP800-61, what is the next step in the recovery process?

   • AMonitor the systems for signs of reinfection or residual compromise
   • BDisconnect the systems from the network again
   • CDelete all backups to prevent reinfection
   • DConduct a lessons-learned meeting immediately
   Reveal Solution Discussion Select an answer first