Analyze the Significance of Incident Recovery Plan Execution and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A financial services firm is updating its incident recovery plan. The plan must clearly define who is responsible for restoring the customer database, who approves the activation of the recovery plan, and how the IT team will communicate status to executives. Which component should the plan include to address all of these requirements?

   • AA communication plan that specifies the frequency and format of status updates to executives and other stakeholders.
   • BA roles and responsibilities matrix that includes the recovery team lead, the incident commander, and the public relations officer.
   • CA section that lists the recovery team members, the approval authority for plan activation, and the executive communication cadence.
   • DA detailed procedure for restoring the customer database from backup, including the exact commands and verification steps.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization has an incident recovery plan that includes restoring the customer relationship management (CRM) system. The plan specifies an RTO of 2 hours and an RPO of 30 minutes. The recovery team has never tested the CRM restoration procedure. What should the organization do to validate the recovery plan?

   • APerform a full restoration of the CRM system in a test environment and measure the time taken.
   • BReview the recovery plan document to ensure all steps are listed.
   • CConduct a tabletop exercise where the team walks through the CRM restoration steps without actually performing them.
   • DWait until the next real incident to see if the plan works.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which NIST CSF function does RECOVER coordinate with to ensure that restored systems are protected against future incidents?

   • ADETECT
   • BPROTECT
   • CGOVERN
   • DIDENTIFY
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why is documenting lessons learned important after an incident recovery?

   • ATo assign blame to specific individuals
   • BTo create a record for marketing purposes
   • CTo satisfy legal requirements only
   • DTo improve future incident response and recovery efforts
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After restoring systems from a ransomware attack, the recovery team has brought the critical applications back online. What should the team do next as part of post-recovery activities?

   • AImmediately close the incident and return to normal operations.
   • BMonitor the restored systems for any signs of residual malware or unusual activity.
   • CDelete all backups to free up storage space.
   • DDisable logging on the restored systems to improve performance.
   Reveal Solution Discussion Select an answer first