5.4 Map Elements to These Steps of Analysis Based on the NIST.SP800-61 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC analyst receives an alert about a possible brute-force attack on a user account. The analyst checks the authentication logs and sees multiple failed login attempts from a single IP address. According to NIST.SP800-61, what should the analyst do next?

   • AEscalate the alert to the CSIRT without further analysis
   • BBlock the IP address at the firewall
   • CImmediately reset the user's password
   • DValidate the alert and determine if the attack is ongoing or successful
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After a security incident, the incident response team discovers that the CSIRT lacked a clear chain of command, causing delays in decision-making. According to NIST.SP800-61, what is the most appropriate action to take during the post-incident analysis phase?

   • ADocument the issue and update the incident response plan to define the chain of command
   • BReassign the CSIRT members to different roles
   • CPurchase a new incident management tool
   • DConduct another incident simulation to test the team
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In the NIST SP 800-61 incident response lifecycle, which activity is part of the detection and analysis phase?

   • ARestoring systems from backups
   • BReviewing the incident response plan for improvements
   • CMonitoring for signs of incidents
   • DImplementing firewall rules to block malicious IPs
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which step is part of the containment, eradication, and recovery phase in NIST SP 800-61?

   • AAcquiring forensic tools
   • BIdentifying improvements for the incident response plan
   • CRemoving the threat from affected systems
   • DPerforming initial analysis to determine impact
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   After a major incident, the incident response team identifies that the detection phase was delayed because the SIEM lacked a correlation rule for the attack pattern. The team is now in the post-incident analysis phase. According to NIST.SP800-61, what is the most effective improvement to prevent recurrence?

   • AReplace the SIEM with a different vendor's product
   • BConduct more frequent tabletop exercises
   • CUpdate the SIEM with new correlation rules and adjust the incident response plan to include regular rule reviews
   • DDocument the issue in the incident report but take no further action
   Reveal Solution Discussion Select an answer first