Analyze the Significance of Incident Recovery Plan Execution and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When prioritizing recovery actions, which factor should be considered most important?

   • AThe cost of the recovery tools
   • BThe number of users affected
   • CThe business impact of the system being down
   • DThe ease of restoring the system
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which sequence best represents the typical steps in executing an incident recovery plan?

   • AContain the incident, eradicate the threat, and then recover systems
   • BActivate the plan, restore systems, verify functionality, and document lessons learned
   • CPatch all systems, update antivirus definitions, and then reboot the network
   • DIdentify the incident, report it to management, and then continue normal operations
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After a successful recovery from a ransomware attack, the recovery team has restored all critical systems and confirmed they are clean. What should the team do as part of post-recovery activities?

   • AImmediately delete all backups to free up storage space.
   • BDocument lessons learned and update the recovery plan based on what worked and what did not.
   • CDisable monitoring on the restored systems to reduce noise.
   • DClose the incident without any further review.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of a security control applied during recovery?

   • ASkipping security patches to speed up restoration
   • BRestoring from the most recent backup regardless of its integrity
   • CUsing default credentials for restored systems
   • DRestoring from a backup that is known to be clean
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A multinational corporation is updating its incident recovery plan. The plan must address the following: who is responsible for restoring each system, how to prioritize recovery across different business units, and how to communicate with regulators in different countries. Which component should the plan include to address all of these requirements?

   • AA list of all backup locations and the frequency of backups.
   • BA single point of contact for all communication, including regulators.
   • CA detailed technical runbook for each system, including restoration commands and verification steps.
   • DA roles and responsibilities matrix, a business impact analysis, and a communication plan that includes regulatory contacts.
   Reveal Solution Discussion Select an answer first