5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company's SOC analyst detects a possible malware infection on a server. The analyst is unsure whether the alert is a true positive. The incident response plan requires that the analyst consult with the threat intelligence team, but the threat intelligence team is understaffed and cannot respond immediately. The network team has noticed unusual traffic from the server. Which action should the analyst take?

   • AWait for the threat intelligence team to respond before taking any action
   • BIgnore the alert because the threat intelligence team is unavailable
   • CImmediately isolate the server without further analysis
   • DGather additional context from the network team's observations and correlate with available threat intelligence feeds, then escalate to the incident response team lead
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A university's SOC receives an alert from the endpoint protection platform about a suspicious PowerShell command on a faculty member's laptop. The SOC analyst needs to determine if this is a false positive or a real compromise. Which two stakeholder groups are most likely to be involved in this analysis, and what is their combined contribution?

   • ASystem administrators and forensic analysts; they immediately reimage the laptop and preserve evidence
   • BSOC analysts and threat intelligence team; they correlate the command with known threat actor techniques
   • CExecutive management and public relations; they prepare a statement about a potential cyber incident
   • DLegal and compliance officers; they determine if the faculty member violated the acceptable use policy
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In the NIST SP 800-61 incident response lifecycle, which phase includes activities such as creating incident response policies, forming a response team, and providing training?

   • AContainment, Eradication, and Recovery
   • BPost-Incident Activity
   • CPreparation
   • DDetection and Analysis
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In the context of CMMC, which stakeholder is responsible for ensuring that incident response practices are implemented and maintained at the required maturity level?

   • APublic relations
   • BSOC analysts
   • CNetwork engineers
   • DManagement
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A hospital's IT team has isolated an infected workstation and is now ready to recover the system. The incident response plan requires that the system be restored to a known good state. Which stakeholder should perform the recovery action?

   • AThe system administrator, following the incident response plan's recovery procedures
   • BThe forensic analyst, because they need to document the recovery
   • CThe incident response team lead, because they coordinate the entire response
   • DThe SOC analyst, because they detected the infection
   Reveal Solution Discussion Select an answer first