Describe the Controls and Techniques in the Incident Response Life Cycle, Contingency Plan, and Business Continuity Plan. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company has a well-documented incident response plan that includes containment and eradication steps. However, after a recent ransomware attack, the company failed to restore operations within its defined recovery time objective because the contingency plan did not specify which backups were critical for restoration. Which interrelationship gap is most evident?

   • AThe business continuity plan was not aligned with the incident response plan
   • BThe contingency plan did not include activation criteria
   • CThe incident response team lacked forensic tools
   • DThe incident response plan did not feed lessons learned into the contingency plan
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During a major cyber incident, which plan is most directly responsible for ensuring that critical business functions continue operating while technical teams respond?

   • AIncident response plan
   • BBusiness continuity plan
   • CDisaster recovery plan
   • DContingency plan
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A hospital's contingency plan for its electronic health records (EHR) system includes a requirement to test the plan every six months. The IT team performs a full-scale test where they actually fail over to the backup system and restore data. What is the primary benefit of this type of test over a tabletop exercise?

   • AIt requires less preparation time
   • BIt does not require any downtime
   • CIt is less expensive and less disruptive
   • DIt validates that the technical recovery procedures work in practice
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial firm's incident response team is analyzing a suspected data breach. They need to preserve evidence in a way that is legally defensible and can be used in court. Which technique should they use during the detection and analysis phase?

   • ARun antivirus scans on the affected systems to identify malware
   • BImmediately shut down affected systems to prevent further damage
   • CCreate a forensic image of affected systems using write-blockers
   • DReview system logs to identify the attack vector
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a security incident, the incident response team needs to communicate with external stakeholders, including law enforcement and customers, while ensuring that sensitive details are not leaked. Which control should be in place to manage this communication?

   • AA forensic tool that preserves evidence
   • BA playbook that outlines technical response steps
   • CA containment strategy that isolates affected systems
   • DA predefined communication plan with designated spokespersons
   Reveal Solution Discussion Select an answer first