Describe the Controls and Techniques in the Incident Response Life Cycle, Contingency Plan, and Business Continuity Plan. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization is developing a playbook for responding to phishing incidents. The playbook should include steps for identifying affected users, resetting credentials, and scanning for malware. Which phase of the incident response life cycle does this playbook primarily support?

   • AContainment
   • BLessons learned
   • CDetection and analysis
   • DPreparation
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has a contingency plan for its data center and a business continuity plan for its customer service operations. During a fire in the data center, the contingency plan is activated, and IT begins restoring systems. However, customer service cannot operate because the phone system is down, and the BCP does not include a procedure for rerouting calls. What is the most likely gap in the company's planning?

   • AThe incident response plan was not followed
   • BThe BCP does not address the dependency on the data center's systems
   • CThe BCP was not tested
   • DThe contingency plan was not activated quickly enough
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the NIST incident response life cycle, which phase involves restoring affected systems to a known good state and validating that they operate normally before returning them to production?

   • AContainment
   • BRecovery
   • CEradication
   • DLessons Learned
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which business continuity plan element involves conducting exercises to validate the plan's effectiveness and identify areas for improvement?

   • ARecovery strategies
   • BBusiness impact analysis
   • CContinuity procedures
   • DPlan testing and updating
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A university's contingency plan for its student information system includes a requirement to test the plan annually. The IT team performs a tabletop exercise where key personnel walk through the activation and recovery steps without actually executing them. What is the primary purpose of this type of test?

   • ATo measure the actual time it takes to recover the system
   • BTo validate the plan's procedures and identify gaps in roles and responsibilities
   • CTo ensure that the plan is compliant with regulatory requirements
   • DTo verify that backups can be restored within the recovery time objective
   Reveal Solution Discussion Select an answer first