Comprehend the Reporting and Communication Aspects of Incident Response. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   During a cybersecurity incident, an organization's incident response plan requires that all incidents be reported to a central point of contact. What is the primary purpose of this reporting procedure?

   • ATo ensure that the incident is automatically resolved without human intervention
   • BTo ensure that all incidents are reported to external regulatory bodies immediately
   • CTo ensure that the incident is kept confidential and not shared with any internal teams
   • DTo ensure that incidents are tracked, prioritized, and assigned to the appropriate response team
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A regional bank detects a ransomware outbreak that has encrypted files on a segment of its internal network. The incident response team has confirmed the scope and is about to begin containment. The bank's legal counsel has advised that the breach may involve customer personal data. Which action should the incident response team take FIRST regarding external communications?

   • AContact the organization's cyber insurance provider to confirm coverage and reporting requirements.
   • BIssue a public statement to customers and the media to maintain transparency.
   • CInform the organization's executive leadership and legal counsel of the incident and its potential regulatory implications.
   • DNotify the relevant law enforcement agency before taking any containment actions.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of documenting incident response activities during an incident?

   • ATo satisfy the personal preference of the incident response team
   • BTo provide a record for post-incident review and improvement
   • CTo delay the incident response process
   • DTo share the incident details with the public
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of a post-incident report delivered to management?

   • ATo summarize the incident, response actions, and lessons learned
   • BTo provide a detailed technical log of every system event
   • CTo assign blame to individuals for the incident
   • DTo serve as a public relations statement
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   During an active cybersecurity incident, the incident response team needs to coordinate actions in real time. Which communication channel is most appropriate for this purpose?

   • AA scheduled weekly status meeting
   • BA dedicated incident response chat channel with the response team
   • CPersonal email between team members
   • DPublic social media posts
   Reveal Solution Discussion Select an answer first