Analyze the Significance of Incident Recovery Plan Execution and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a cyber incident, the RESPOND function has contained the threat, and the RECOVER function is about to start restoring systems. The PROTECT function has identified that some security controls were not effective during the incident. What should the RECOVER function do to coordinate with PROTECT?

   • AIgnore PROTECT's findings and focus only on restoring systems quickly.
   • BWait for PROTECT to complete a full risk assessment before starting recovery.
   • CProceed with recovery and let PROTECT handle any issues later.
   • DAsk PROTECT to implement additional security controls before recovery begins.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of testing recovery procedures?

   • ATo replace the need for a recovery plan
   • BTo ensure that the procedures are effective and can be executed successfully
   • CTo identify the root cause of the incident
   • DTo assign blame for failures
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is recovering from a cyber incident that affected its customer portal. The recovery team is restoring the portal, and the customer support team is receiving inquiries from customers about service availability. What is the best way to communicate with customers during the recovery?

   • AHave the recovery team lead personally call each affected customer.
   • BProvide the customer support team with regular updates on recovery progress so they can inform customers.
   • CTell customers that the portal will be back online within 24 hours, even if that is not certain.
   • DDo not communicate with customers until the portal is fully restored.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why is it important to apply security controls during the recovery process?

   • ATo reduce the cost of recovery
   • BTo ensure that restored systems are not vulnerable to the same or new threats
   • CTo speed up the recovery process
   • DTo comply with data retention policies
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which group is considered a key stakeholder that should be communicated with during recovery?

   • ASenior management
   • BCompetitors
   • CSocial media influencers
   • DThe general public
   Reveal Solution Discussion Select an answer first