A company's incident response team has confirmed a worm that is spreading across the network. The team lead must decide whether to disconnect all affected systems from the network or to keep them connected to monitor the worm's behavior. The company has a low tolerance for downtime, but the worm is encrypting files. Which decision best balances the need for containment with the need for monitoring?

Shut down all affected systems immediately to preserve evidence

Disconnect the affected systems to stop the spread, while using network taps to monitor the worm's behavior without risking further encryption

Disconnect only the most critical systems and leave the rest connected for monitoring

Keep the systems connected to monitor the worm's behavior, accepting the risk of further encryption

A hospital's SOC receives an alert from its EDR about a workstation beaconing to an unknown external IP. The SOC analyst needs to determine whether this is a true positive. Which two stakeholder groups should the analyst consult to validate the alert and gather context?

The threat intelligence team and the network engineering team

The incident response team lead and the CISO

The legal department and the public relations team

The system administrators and the forensic analysts

A government contractor is updating its incident response plan to align with CMMC Level 2 and NIST SP 800-61. The CISO wants to ensure that the plan includes a process for coordinating with external stakeholders such as law enforcement and the MSSP. The legal team is concerned about sharing sensitive information with external parties. Which approach best addresses both coordination and legal concerns?

Prohibit all external communication during an incident to avoid legal exposure

Define a communication plan in the Preparation phase that specifies what information can be shared with each external party and under what conditions

Include external parties in all incident response meetings without restrictions

Allow the SOC manager to decide on a case-by-case basis what to share with external parties

CiscoCertified CyberOps Associate

Domain 5Objective 5

5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 2)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

15%of the exam

Questions 6–10

6foundation · easy
According to NIST SP 800-61, which stakeholder is responsible for coordinating with external parties, such as law enforcement, during an incident?
Select an answer first
7expert · hard
A company's incident response team has confirmed a worm that is spreading across the network. The team lead must decide whether to disconnect all affected systems from the network or to keep them connected to monitor the worm's behavior. The company has a low tolerance for downtime, but the worm is encrypting files. Which decision best balances the need for containment with the need for monitoring?
Select an answer first
8application · medium
A hospital's SOC receives an alert from its EDR about a workstation beaconing to an unknown external IP. The SOC analyst needs to determine whether this is a true positive. Which two stakeholder groups should the analyst consult to validate the alert and gather context?
Select an answer first
9expert · hard
A government contractor is updating its incident response plan to align with CMMC Level 2 and NIST SP 800-61. The CISO wants to ensure that the plan includes a process for coordinating with external stakeholders such as law enforcement and the MSSP. The legal team is concerned about sharing sensitive information with external parties. Which approach best addresses both coordination and legal concerns?
Select an answer first
10foundation · easy
In NIST SP 800-61, which stakeholder is responsible for preserving evidence and maintaining chain of custody during an incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 2)

Questions 6–10

According to NIST SP 800-61, which stakeholder is responsible for coordinating with external parties, such as law enforcement, during an incident?

A hospital's SOC receives an alert from its EDR about a workstation beaconing to an unknown external IP. The SOC analyst needs to determine whether this is a true positive. Which two stakeholder groups should the analyst consult to validate the alert and gather context?

In NIST SP 800-61, which stakeholder is responsible for preserving evidence and maintaining chain of custody during an incident?

Keep studying — 5.0 Security Policies and Procedures