A company has just completed the recovery phase of a ransomware incident. The incident response team lead wants to ensure that the organization learns from the incident and improves its response capabilities. Which activity should be performed during the Post-Incident Activity phase?

Immediately delete all logs and evidence to free up storage

Notify all customers about the incident, regardless of impact

Conduct a lessons-learned meeting and update the incident response plan based on findings

Restore all systems from backup and resume normal operations

A company has confirmed a ransomware infection on a critical database server. The incident response team lead must decide whether to isolate the server immediately or preserve forensic evidence first. The database contains customer data, and the company has regulatory obligations to report breaches. Which action should the team lead take first?

Isolate the server from the network to stop the spread, while taking a memory snapshot for forensics

Perform a full forensic disk image before any isolation

Notify regulatory authorities before taking any technical action

Shut down the server immediately to preserve evidence

A defense contractor that handles CUI is implementing CMMC Level 2 practices. The company wants to ensure that incident response procedures are documented and that the right stakeholders are assigned to each phase. Which approach best aligns with CMMC requirements?

Create a single incident response plan that applies to all systems, without specifying stakeholder roles

Rely on the existing IT team's informal knowledge of what to do during an incident

Outsource all incident response to a third-party provider without internal stakeholder mapping

Document the incident response plan, assign a responsible stakeholder for each phase, and test the plan periodically

CiscoCertified CyberOps Associate

Domain 5Objective 5

5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 3)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

15%of the exam

Questions 11–15

11application · medium
A company has just completed the recovery phase of a ransomware incident. The incident response team lead wants to ensure that the organization learns from the incident and improves its response capabilities. Which activity should be performed during the Post-Incident Activity phase?
Select an answer first
12expert · hard
A company has confirmed a ransomware infection on a critical database server. The incident response team lead must decide whether to isolate the server immediately or preserve forensic evidence first. The database contains customer data, and the company has regulatory obligations to report breaches. Which action should the team lead take first?
Select an answer first
13application · medium
A defense contractor that handles CUI is implementing CMMC Level 2 practices. The company wants to ensure that incident response procedures are documented and that the right stakeholders are assigned to each phase. Which approach best aligns with CMMC requirements?
Select an answer first
14foundation · easy
In the Preparation phase of incident response, which stakeholder is responsible for developing and reviewing the incident response plan to ensure it meets regulatory and legal requirements?
Select an answer first
15foundation · easy
Which stakeholder is typically responsible for executing containment actions, such as isolating affected systems from the network, during an incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 3)

Questions 11–15

A company has just completed the recovery phase of a ransomware incident. The incident response team lead wants to ensure that the organization learns from the incident and improves its response capabilities. Which activity should be performed during the Post-Incident Activity phase?

A defense contractor that handles CUI is implementing CMMC Level 2 practices. The company wants to ensure that incident response procedures are documented and that the right stakeholders are assigned to each phase. Which approach best aligns with CMMC requirements?

In the Preparation phase of incident response, which stakeholder is responsible for developing and reviewing the incident response plan to ensure it meets regulatory and legal requirements?

Which stakeholder is typically responsible for executing containment actions, such as isolating affected systems from the network, during an incident?

Keep studying — 5.0 Security Policies and Procedures