Describe the Controls and Techniques in the Incident Response Life Cycle, Contingency Plan, and Business Continuity Plan. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which control is most directly associated with the containment phase of incident response?

   • AIsolating affected systems from the network
   • BRestoring systems from backups
   • CDeveloping an incident response plan
   • DConducting a lessons-learned review
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's contingency plan includes a procedure for restoring the email system from backups. The plan also specifies that the backup tapes must be stored offsite. Which component of the contingency plan does this offsite storage requirement address?

   • ARecovery procedures
   • BActivation criteria
   • CTesting and maintenance
   • DRoles and responsibilities
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During a ransomware incident, the incident response team decides to isolate the infected systems by disconnecting them from the network. They also block the ransomware's command-and-control traffic at the firewall. Which containment strategy are they using?

   • AData backup restoration
   • BCredential revocation
   • CSystem shutdown
   • DNetwork segmentation and isolation
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How do the incident response life cycle, contingency plan, and business continuity plan interrelate to support organizational resilience?

   • AThe contingency plan is the primary plan, and the other two are only used if the contingency plan fails.
   • BIncident response focuses on immediate technical response, while contingency and business continuity plans address broader recovery and continuity.
   • CThe business continuity plan is only for natural disasters, while incident response is only for cyberattacks.
   • DThey are independent plans that are activated in sequence, with no overlap in purpose.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company's incident response plan includes a step to isolate affected systems to prevent malware spread. However, the business continuity plan requires that the customer portal remain available with minimal downtime. During an incident, the IR team isolates the portal server, causing a 6-hour outage, which exceeds the BCP's RTO of 2 hours. What should the company do to prevent this conflict in the future?

   • ARequire the IR team to obtain approval from the BCP team before any containment action
   • BEliminate the containment step from the IR plan to avoid outages
   • CIntegrate the IR and BCP planning processes to align containment actions with continuity requirements
   • DIncrease the BCP's RTO to 6 hours
   Reveal Solution Discussion Select an answer first