5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A defense contractor is pursuing CMMC Level 2 certification. The company has a small IT staff: one IT manager, two system administrators, and one part-time SOC analyst. The CISO wants to map stakeholders to the NIST SP 800-61 incident response categories. The company also handles CUI and must demonstrate that incident response practices are documented and followed. Which stakeholder mapping best balances CMMC Level 2 requirements with the limited staff?

   • AAssign the IT manager as the incident response team lead, the system administrators as responders for containment and recovery, and the SOC analyst for detection, with all roles documented in the plan
   • BOutsource the entire incident response function to a managed security service provider and document that the provider is responsible for all phases
   • CDocument that incident response is handled informally by the IT staff and that formal role assignment is not required at Level 2
   • DAssign all incident response roles to the SOC analyst, since they have the most security training
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   During the Preparation phase of incident response, which stakeholder is primarily responsible for ensuring that the incident response team has the necessary budget and authority to act?

   • AManagement
   • BPublic relations
   • CIT support staff
   • DLegal counsel
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A defense contractor is implementing CMMC Level 2 and must map stakeholders to incident response categories. The company has a small IT team and cannot afford a dedicated incident response team. The CISO wants to ensure that the mapping is compliant and that the company can demonstrate process maturity. Which approach is most appropriate?

   • AUse a generic incident response plan from the internet and fill in the company name
   • BCreate a matrix that assigns all phases to the IT manager, since they have the most authority
   • CDefine clear roles for each phase, assign them to existing staff, and document the process in the incident response plan
   • DWait until the company grows before implementing formal incident response processes
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A manufacturing company has confirmed that a workstation is infected with ransomware. The incident response team lead has decided to isolate the host from the network, remove the malware, and restore the system from a known-good backup. Which stakeholders are primarily responsible for executing these actions?

   • ASOC analysts and threat intelligence team
   • BLegal and compliance officers
   • CExecutive management and public relations
   • DIncident responders and system administrators
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A financial services firm has confirmed a malware infection on several workstations. The incident response plan calls for eradicating the malware and recovering the systems. Which stakeholder group is primarily responsible for eradicating the malware from the affected workstations?

   • AThe SOC analysts, because they identified the malware
   • BThe system administrators, following the incident responders' approved eradication procedures
   • CThe forensic analysts, because they need to preserve evidence during eradication
   • DThe management team, because they approve the eradication budget
   Reveal Solution Discussion Select an answer first