Comprehend the Reporting and Communication Aspects of Incident Response. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which type of information should be included in incident documentation to support a thorough post-incident review?

   • AOnly the final outcome of the incident
   • BPersonal opinions of team members about the incident
   • CTimestamps of key actions, decisions made, and evidence collected
   • DThe names of all employees in the organization
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An organization has detected a ransomware attack that is affecting a critical business system. Which stakeholder should be notified first according to typical incident response procedures?

   • AThe public relations department
   • BAll employees via a company-wide email
   • CThe organization's customers
   • DThe incident response team and internal management
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A small business experiences a denial-of-service (DoS) attack that disrupts its website. The owner is unsure about reporting the incident. According to standard incident reporting procedures, which action should the owner take FIRST?

   • AReport the incident to the local news media
   • BPost details of the attack on social media to warn customers
   • CWait to see if the attack stops on its own before reporting
   • DContact the organization's internal IT support or managed security service provider
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational corporation experiences a data breach that affects customers in multiple countries with different data protection regulations. The incident response team must determine the reporting requirements. Which approach is MOST appropriate?

   • AReport the breach only to the authorities in the country where the company is headquartered
   • BReport the breach to all relevant authorities in each affected jurisdiction, following local regulations
   • CWait for a unified global regulation to be established before reporting
   • DReport the breach only to the customers, not to any authorities
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During a data breach involving customer personal data, which stakeholders must be notified in a timely manner according to typical incident response requirements?

   • AOnly the internal IT team
   • BThe general public and all media outlets
   • COnly the organization's legal department
   • DInternal management, affected customers, and relevant regulatory authorities
   Reveal Solution Discussion Select an answer first