5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which stakeholder group is primarily responsible for monitoring network traffic and analyzing alerts to detect potential security incidents?

   • AForensic analysts
   • BSystem administrators
   • CSOC analysts
   • DPublic relations
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A regional bank is updating its incident response plan. The CISO wants to ensure that before any incident occurs, the organization has defined escalation paths, trained staff, and established communication channels with external parties such as law enforcement and the managed security service provider. During which NIST SP 800-61 lifecycle phase should these activities be formalized, and which stakeholder group is primarily responsible for driving them?

   • AContainment, Eradication, and Recovery phase; system administrators and forensic analysts
   • BPreparation phase; executive management and the incident response team lead
   • CPost-Incident Activity phase; legal and compliance officers
   • DDetection and Analysis phase; SOC analysts and threat intelligence team
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A defense contractor is preparing for a CMMC Level 2 assessment. The assessor asks how the organization ensures that incident response procedures are tested and that personnel are trained. Which CMMC practice directly addresses this requirement, and which stakeholder is typically responsible for coordinating the training?

   • AIR.2.095 – Implement incident response training; the incident response team lead
   • BIR.2.092 – Establish an operational incident-handling capability; the CISO
   • CIR.2.094 – Analyze and respond to incidents; system administrators
   • DIR.2.093 – Detect and report events; SOC analysts
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A manufacturing company has confirmed a ransomware infection on a production server. The incident response plan requires isolating the host, preserving evidence, and restoring from backups. Which stakeholder group should lead the containment action of disconnecting the server from the network?

   • AThe legal department, because they decide whether to pay the ransom
   • BThe forensic analysts, because they must preserve evidence before any action
   • CThe incident responders, with support from the system administrator
   • DThe SOC analysts, because they detected the ransomware
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A defense contractor is implementing CMMC Level 2 and must map its incident response stakeholders to NIST SP 800-61 categories. The contractor has a small IT team where the same person often serves as both SOC analyst and system administrator. The CISO wants to ensure that CMMC practice IR.2.092 is satisfied without creating a conflict of interest in incident response. Which approach best addresses this constraint?

   • ADelay CMMC implementation until the IT team is large enough to have dedicated roles
   • BAssign all incident response roles to a single incident commander to avoid confusion
   • COutsource the entire incident response function to an MSSP to avoid internal role conflicts
   • DDocument the dual roles in the incident response plan and define separation of duties where feasible, such as having a different person authorize containment actions
   Reveal Solution Discussion Select an answer first