Comprehend the Reporting and Communication Aspects of Incident Response. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   An organization's incident response plan specifies communication protocols for different types of incidents. Which protocol is typically used for a low-severity incident that does not require immediate action?

   • AReal-time phone call to all team members
   • BAn emergency broadcast to the entire organization
   • CA public announcement on the company website
   • DA formal written report sent via email to the incident response team
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial services firm detects a potential insider threat involving unauthorized access to customer accounts. The incident response team is determining which stakeholders to notify. Which stakeholder should be notified FIRST?

   • AThe affected customers
   • BThe organization's competitors
   • CThe organization's legal counsel and human resources department
   • DThe public via a press release
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During a multi-organization incident response exercise, a company needs to share indicators of compromise (IOCs) with a trusted partner organization. The IOCs include IP addresses and file hashes. Which method is MOST appropriate for sharing this information securely?

   • AEmail the IOCs to the partner's general contact address
   • BSend the IOCs via a shared, encrypted collaboration platform with access controls
   • CVerbally communicate the IOCs over a public phone line
   • DPost the IOCs on the company's public website
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An incident response team is sharing threat intelligence with a partner organization. The partner requests the full raw logs from the affected systems. The team's legal counsel advises that the logs contain personal data. What is the MOST appropriate action?

   • ARefuse to share any information with the partner
   • BShare the full raw logs as requested, since the partner is trusted
   • CShare only the relevant IOCs and sanitized data, excluding personal information
   • DShare the logs after removing the timestamps
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   An employee discovers a potential security incident and needs to report it according to the organization's incident response plan. Which action best aligns with standard incident reporting procedures?

   • APost details of the incident on an internal collaboration platform to inform all employees
   • BReport the incident using the designated reporting channel, such as a security hotline or email alias
   • CAttempt to contain the incident first and report it only after the threat is neutralized
   • DReport the incident to the immediate supervisor only, and wait for further instructions
   Reveal Solution Discussion Select an answer first