Describe the Controls and Techniques in the Incident Response Life Cycle, Contingency Plan, and Business Continuity Plan. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company's incident response team is responding to a suspected data exfiltration. They have identified the affected systems and are now deciding whether to disconnect them from the network or leave them connected to monitor the attacker's activity. The legal team wants to preserve evidence, while the security team wants to prevent further data loss. What is the most appropriate action?

   • AImmediately shut down the systems to preserve evidence
   • BLeave the systems connected to monitor the attacker and gather more evidence
   • CDisconnect the systems to prevent further data loss, but first capture volatile data and network connections
   • DDisconnect the systems without collecting any data first
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has a business continuity plan that ensures customer-facing services remain available during a disruption. However, during a recent cyberattack, the incident response team's containment actions inadvertently caused a longer outage than the BCP's recovery time objective allowed. What is the most likely reason for this conflict?

   • AThe incident response team lacked forensic tools
   • BThe contingency plan was not activated
   • CThe BCP and IR plan were not coordinated, leading to conflicting priorities
   • DThe BCP was not tested regularly
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   During which phase of the incident response life cycle does an organization develop and maintain incident handling procedures, tools, and training before an incident occurs?

   • ADetection and Analysis
   • BPreparation
   • CContainment
   • DRecovery
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company's business continuity plan includes a recovery strategy that relies on a hot site. However, the budget for the hot site was cut, and the company is considering switching to a cold site. The BIA shows that the order processing system has an RTO of 4 hours and an RPO of 1 hour. Which of the following is the most significant risk of switching to a cold site?

   • AThe cold site will not have any backup data
   • BThe cold site may not have the necessary hardware and software to restore systems within the RTO
   • CThe cold site is not secure enough for sensitive data
   • DThe cold site cannot support the RPO of 1 hour
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which business continuity plan element identifies the potential impacts of a disruption on critical business functions?

   • ABusiness impact analysis
   • BContinuity procedures
   • CPlan testing and updating
   • DRecovery strategies
   Reveal Solution Discussion Select an answer first