According to NIST SP 800-61, which of the following correctly lists the four phases of the incident response lifecycle?

Detection; Analysis; Containment; Eradication; Recovery; Post-Incident Activity

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity

Preparation; Detection; Containment; Eradication; Recovery; Lessons Learned

Preparation; Identification; Containment; Eradication; Recovery; Lessons Learned

A cloud service provider's SOC receives an alert about a possible brute-force attack on a customer's account. The analyst needs to determine if the attack is ongoing and whether other customers are affected. Which stakeholders should be involved in this Detection and Analysis phase?

SOC analysts, threat intelligence team, and network engineers

Legal, public relations, and human resources

The CISO and the board of directors

System administrators and forensic analysts only

A company has just completed a major incident response. The incident response team lead wants to conduct a lessons-learned meeting, but the legal department is concerned about creating discoverable records that could be used in litigation. The compliance officer wants to ensure that the company meets regulatory requirements for incident reporting. Which approach best addresses both concerns?

Have the legal department write the minutes and share them with all employees

Cancel the lessons-learned meeting to avoid creating any records

Conduct the lessons-learned meeting under attorney-client privilege and create a separate compliance report that meets regulatory requirements

Share the full meeting minutes with the compliance officer only

CiscoCertified CyberOps Associate

Domain 5Objective 5

5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 4)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

15%of the exam

Questions 16–20

16foundation · easy
According to NIST SP 800-61, which of the following correctly lists the four phases of the incident response lifecycle?
Select an answer first
17application · medium
A cloud service provider's SOC receives an alert about a possible brute-force attack on a customer's account. The analyst needs to determine if the attack is ongoing and whether other customers are affected. Which stakeholders should be involved in this Detection and Analysis phase?
Select an answer first
18foundation · easy
During the Detection and Analysis phase, which stakeholder provides contextual information about network architecture and traffic flows to help analysts determine if an alert is a true positive?
Select an answer first
19expert · hard
A company has just completed a major incident response. The incident response team lead wants to conduct a lessons-learned meeting, but the legal department is concerned about creating discoverable records that could be used in litigation. The compliance officer wants to ensure that the company meets regulatory requirements for incident reporting. Which approach best addresses both concerns?
Select an answer first
20foundation · easy
Which stakeholder is responsible for leading the post-incident review and ensuring that lessons learned are documented and acted upon?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 4)

Questions 16–20

According to NIST SP 800-61, which of the following correctly lists the four phases of the incident response lifecycle?

A cloud service provider's SOC receives an alert about a possible brute-force attack on a customer's account. The analyst needs to determine if the attack is ongoing and whether other customers are affected. Which stakeholders should be involved in this Detection and Analysis phase?

During the Detection and Analysis phase, which stakeholder provides contextual information about network architecture and traffic flows to help analysts determine if an alert is a true positive?

Which stakeholder is responsible for leading the post-incident review and ensuring that lessons learned are documented and acted upon?

Keep studying — 5.0 Security Policies and Procedures