Analyze the Significance of Incident Recovery Plan Execution and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a key post-recovery activity?

   • ADeleting all logs related to the incident
   • BImmediately returning to normal operations without review
   • CDisabling all security controls
   • DMonitoring systems for residual issues
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a key component of an incident recovery plan?

   • AA detailed map of the organization's physical office locations
   • BA list of all software licenses owned by the organization
   • CDefined roles and responsibilities for the recovery team
   • DA list of all employees' personal contact information
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of executing an incident recovery plan within the NIST Cybersecurity Framework's RECOVER Function?

   • ATo restore systems and services that were affected by the incident to normal operation
   • BTo identify the root cause of the incident and implement preventive measures
   • CTo continuously monitor for potential threats and vulnerabilities
   • DTo contain the incident and limit the spread of the attack
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   After a malware outbreak, an organization is restoring its file servers from backups. The recovery plan requires that restored systems be free of vulnerabilities and that the restoration process itself does not introduce new risks. Which control should the recovery team implement during the restoration process?

   • AUse the most recent backup without verification to speed up recovery.
   • BRestore the servers directly to the production network to minimize downtime.
   • CDisable security software on the restored servers to improve performance.
   • DScan the restored servers with antivirus before connecting them to the production network.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A manufacturing company has three systems that were affected by a cyber incident: the production control system (PCS), the payroll system, and the employee email system. The PCS is critical for manufacturing operations, the payroll system is needed for end-of-month processing, and email is used for internal communication. The recovery team has limited resources and must restore systems in order. Which order should the team follow?

   • APCS first, then payroll, then email.
   • BEmail first, then payroll, then PCS.
   • CRestore all systems simultaneously to minimize overall downtime.
   • DPayroll first, then PCS, then email.
   Reveal Solution Discussion Select an answer first