Describe the Significance of Adverse Event Analysis and Associated Security Controls in DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is investigating a series of alerts that appear to be related. The analyst has identified that the alerts share a common command and control (C2) server. What is the most appropriate next step in the analysis process?

   • AEscalate to incident response without further analysis
   • BImmediately block the C2 server IP address
   • CPerform root cause analysis to determine how the C2 communication started
   • DIsolate all affected systems from the network
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing a log entry that shows an unusual command executed on a server. The analyst must determine if this is an adverse event. What is the first step in the analysis process?

   • AEscalate to incident response
   • BCorrelate the command with other logs
   • CPerform root cause analysis
   • DTriage the event to assess its severity
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the broader cybersecurity lifecycle, what is the role of adverse event analysis after an incident has been resolved?

   • AIt is no longer relevant because the incident is over
   • BIt is used solely to calculate financial losses for insurance claims
   • CIt contributes to lessons learned and continuous improvement of detection and response capabilities
   • DIt automatically updates all security policies without human review
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company wants to ensure that its security team is alerted when a user account is locked out multiple times in a short period. Which control is most appropriate?

   • AConfigure an alert in the SIEM for multiple account lockouts
   • BEnable account lockout policy in Active Directory
   • CImplement multi-factor authentication (MFA)
   • DDeploy a network intrusion detection system (NIDS)
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company has a limited security budget and must choose between investing in a SIEM or in endpoint detection and response (EDR) tools. The company's primary concern is detecting advanced threats that evade traditional antivirus. Which investment is more aligned with the DETECT function's goal of adverse event analysis?

   • AEDR, because it provides visibility into endpoint behavior and can detect anomalies
   • BNeither, because the company should focus on prevention rather than detection
   • CBoth are equally important, so the company should split the budget
   • DSIEM, because it provides centralized log management and correlation
   Reveal Solution Discussion Select an answer first