5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Under CMMC, which stakeholder is responsible for documenting and reporting incident response activities to support compliance evidence?

   • AHuman resources
   • BLegal counsel
   • CIncident response team
   • DPublic relations
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A financial services firm is creating its incident response plan. The compliance officer notes that the plan must include procedures for notifying customers and regulators in the event of a data breach. Which stakeholder is best positioned to draft these notification procedures during the Preparation phase?

   • ASOC analysts
   • BLegal and compliance officers
   • CNetwork engineers
   • DSystem administrators
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In the Post-Incident Activity phase, which stakeholder reviews the incident handling process to ensure compliance with data breach notification laws?

   • AForensic analysts
   • BSystem administrators
   • CThreat intelligence analysts
   • DLegal/compliance officers
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   During a ransomware incident, the SOC analyst identifies the affected hosts and the forensic analyst wants to preserve evidence before any containment action. The system administrator wants to immediately disconnect the hosts to stop the spread. The incident response team lead must decide the order of actions. Which approach best balances evidence preservation with the need to contain the incident?

   • ALet the forensic analyst complete a full disk image before any containment action
   • BAsk the SOC analyst to monitor the hosts for additional activity before deciding
   • CPerform a memory capture on the affected hosts, then disconnect them from the network
   • DDisconnect the hosts immediately and then attempt to recover memory from the powered-off systems
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A regional bank is updating its incident response plan. During the Preparation phase, the CISO wants to ensure that the plan includes clear escalation paths, communication templates, and legal hold procedures before any incident occurs. Which stakeholder group should be primarily responsible for drafting and maintaining these Preparation-phase artifacts?

   • AThe public relations team, because communication templates are the most critical artifact
   • BThe incident response team lead, with input from legal, HR, and public relations
   • CThe legal department alone, because legal holds and compliance are legal matters
   • DThe SOC analysts, who will use the plan during detection and analysis
   Reveal Solution Discussion Select an answer first