Analyze the Significance of Incident Recovery Plan Execution and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In an incident recovery plan, what is the purpose of documenting detailed recovery procedures?

   • ATo satisfy regulatory compliance requirements only
   • BTo replace the need for testing the recovery plan
   • CTo provide a step-by-step guide for restoring systems and services
   • DTo assign blame for the incident
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which method is commonly used to validate recovery procedures?

   • ADeleting all backups
   • BWaiting for a real incident
   • CReviewing the plan without any discussion
   • DConducting a tabletop exercise
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why is clear communication with stakeholders important during incident recovery?

   • ATo assign blame for the incident
   • BTo keep stakeholders informed about recovery progress and expected timelines
   • CTo hide the details of the incident from the public
   • DTo delay the recovery process
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization has a recovery plan for its CRM system. The plan specifies an RTO of 2 hours and an RPO of 30 minutes. The recovery team has conducted a tabletop exercise, but has never performed an actual restoration. The organization is considering whether to perform a full restoration test. What is the most important reason to perform a full restoration test?

   • AIt verifies that the backup media is not corrupted.
   • BIt validates that the recovery procedure can meet the RTO and RPO.
   • CIt ensures that all team members know their roles.
   • DIt satisfies regulatory requirements for testing.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How does the RECOVER function coordinate with the RESPOND function?

   • ARecovery replaces the need for response activities
   • BRecovery is the first step in the incident handling process
   • CRecovery begins only after the incident is fully contained and eradicated
   • DRecovery is independent of response activities
   Reveal Solution Discussion Select an answer first