Comprehend the Reporting and Communication Aspects of Incident Response. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When sharing incident information with external parties, such as law enforcement or industry partners, what is a critical requirement to maintain?

   • AShare all technical details without restriction to ensure transparency
   • BShare information only through public channels to ensure broad dissemination
   • CShare information only after the incident is fully resolved
   • DShare only the minimum necessary information while protecting confidentiality and integrity
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   After a cybersecurity incident is resolved, which element is typically included in a post-incident report to help prevent future incidents?

   • AA detailed financial breakdown of the organization's budget
   • BRecommendations for improving security controls and processes
   • CThe personal contact information of the incident response team
   • DA list of all employees who were involved in the incident
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company discovers a breach that involves sensitive customer data. The legal team advises that notification to regulators is required within 72 hours. However, the investigation is ongoing and the full scope is not yet known. What is the MOST appropriate action?

   • AProvide an initial notification with available information and commit to updates as the investigation progresses
   • BProvide a vague notification without any details to avoid inaccuracies
   • CNotify only the affected customers and not the regulators
   • DWait until the investigation is complete to provide a full report
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   After a major incident, the incident response team is preparing a post-incident report. Which element is ESSENTIAL to include in the report for management?

   • AThe personal opinions of the incident response team about the attacker's motives
   • BThe names of all employees who were on vacation during the incident
   • CA list of all employees' personal phone numbers
   • DA detailed timeline of the incident and response actions
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   During a critical incident, the primary incident response communication platform (a chat tool) becomes unavailable due to a network outage. The team needs to continue coordinating. Which alternative communication method is MOST appropriate?

   • APost updates on the company's public social media accounts
   • BStop all communication until the primary platform is restored
   • CUse personal email accounts to continue coordination
   • DSwitch to a pre-established out-of-band communication plan, such as a secure phone bridge or alternate messaging platform
   Reveal Solution Discussion Select an answer first