5.5 Map the Organization Stakeholders Against the NIST IR Categories (CMMC, NIST.SP800-61) 200-201 Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   After a data breach is resolved, a retail company schedules a lessons-learned meeting. The goal is to identify process improvements and update the incident response plan. Which stakeholders should be invited to participate in this post-incident activity?

   • AOnly the SOC analysts who handled the incident
   • BThe public relations team only, because they managed external communications
   • CThe incident response team lead, management, and legal/compliance officers
   • DOnly the external forensic firm that investigated the breach
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A defense contractor that handles CUI is implementing CMMC Level 2 practices. The CISO wants to ensure that incident response procedures are documented and that the right stakeholders are assigned to execute them. Which CMMC practice directly addresses this requirement, and which stakeholder is typically responsible for maintaining the documented procedures?

   • AIR.2.093 – Detect and report events; SOC analysts
   • BIR.2.095 – Implement incident response training; human resources
   • CIR.2.094 – Analyze and respond to incidents; system administrators
   • DIR.2.092 – Establish an operational incident-handling capability; the incident response team lead
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A small business that is a subcontractor in the defense supply chain must comply with CMMC Level 1. The owner wants to map stakeholders to incident response categories but has a limited staff. Which approach is most appropriate for CMMC Level 1?

   • AAssign multiple incident response roles to a single individual, as long as the practices are performed
   • BHire a full-time incident response team to ensure segregation of duties
   • COutsource all incident response to a managed service provider without any internal oversight
   • DDocument that incident response is not applicable because the business is small
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A hospital's SOC receives an alert from the IDS indicating unusual outbound traffic from a medical device to an unknown IP address. The SOC analyst needs to determine whether this is a true positive. Which stakeholders should be involved in this Detection and Analysis phase activity, and what is their primary contribution?

   • ASystem administrators and forensic analysts; they immediately isolate the device and begin disk imaging
   • BLegal and compliance officers; they determine whether the traffic violates HIPAA and notify regulators
   • CExecutive management and public relations; they prepare a press release about a potential breach
   • DSOC analysts and network engineers; they correlate alerts with network flow data and device baselines
   Reveal Solution Discussion Select an answer first