5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A multinational corporation has just completed a ransomware incident that affected its European and Asian data centers. The incident response team lead wants to conduct a post-incident review. The legal team insists on including a discussion of regulatory notification timelines, while the SOC manager wants to focus on technical detection gaps. The CISO has limited time and wants the meeting to produce actionable improvements. Which approach best balances these competing interests?

   • AHold a single lessons-learned meeting with a structured agenda that covers both regulatory compliance and technical detection gaps
   • BInvite only the SOC manager and legal team lead to a private discussion
   • CSkip the post-incident review to save time and focus on restoring operations
   • DHold separate meetings: one for legal/compliance and one for SOC technical staff
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   After an incident is contained, which stakeholder is responsible for restoring affected systems to a known good state and verifying they are operational?

   • APublic relations
   • BSystem administrators
   • CLegal counsel
   • DThreat intelligence analysts
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A financial institution's SOC detects a series of failed login attempts followed by a successful login from an unusual geographic location. The SOC analyst suspects a compromised account. The threat intelligence team has no prior knowledge of the source IP. The CISO wants to avoid a false positive that could disrupt the user's work. Which approach best balances the need for analysis with the risk of disruption?

   • ACorrelate the login event with the user's travel schedule and recent VPN usage before taking action
   • BIgnore the alert because the threat intelligence team has no knowledge of the IP
   • CImmediately disable the user's account and force a password reset
   • DEscalate the alert directly to executive management for a decision
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   After a major security incident, a company's incident response team lead wants to conduct a lessons-learned meeting. The legal department insists that the meeting minutes be protected by attorney-client privilege, while the compliance officer wants the minutes to be shared with all employees to promote security awareness. Which approach best satisfies both concerns?

   • AShare the full meeting minutes with all employees to maximize transparency
   • BHave the legal department write the minutes and share them only with the compliance officer
   • CHold a privileged lessons-learned meeting with legal present, and create a separate sanitized summary for broader distribution
   • DDo not document the lessons learned to avoid creating discoverable records
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A university's SOC detects unusual outbound traffic from a research lab. The analyst suspects a compromised account. According to NIST SP 800-61, which stakeholder should the analyst notify first to begin the Detection and Analysis phase?

   • AThe public relations office, to prepare a public statement
   • BThe university's legal counsel, to assess regulatory notification requirements
   • CThe system administrator of the research lab, to immediately reset the account
   • DThe incident response team lead, who will coordinate the investigation
   Reveal Solution Discussion Select an answer first