Describe the Significance of Adverse Event Analysis and Associated Security Controls in DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is investigating a suspicious alert. The analyst has identified the affected systems and the time of the activity. What is the next step in the adverse event analysis process?

   • APerform root cause analysis to determine the underlying cause of the event.
   • BContain the affected systems to prevent further damage.
   • CEscalate the event to incident response immediately.
   • DTriage the event to determine its severity and priority.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst notices a series of failed login attempts from a single IP address across multiple user accounts over a short period. The analyst must determine whether this constitutes an adverse event and, if so, its severity. Which action best aligns with the DETECT function's adverse event analysis process?

   • AReset all user passwords that were targeted by the failed attempts.
   • BCorrelate the failed attempts with other logs and context to assess if they indicate a potential attack.
   • CImmediately block the IP address at the firewall to prevent further attempts.
   • DIgnore the attempts because failed logins are routine and not considered adverse events.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which analysis technique involves examining multiple seemingly unrelated events to identify a broader pattern of malicious activity?

   • ACorrelation
   • BRoot cause analysis
   • CTriage
   • DContainment
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is reviewing an alert that indicates a user logged in from a foreign country at 3:00 AM local time. The user is known to travel frequently. The analyst must decide whether this is an adverse event. Which approach best aligns with adverse event analysis?

   • ACorrelate the login with the user's travel itinerary and other context
   • BDisable the user's account to prevent potential unauthorized access
   • CIgnore the alert because the user is a frequent traveler
   • DImmediately escalate to incident response because the login is from a foreign country
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   After analyzing an adverse event, the security team creates a detailed report that includes the attack vector, affected systems, and recommended actions. What is the primary purpose of this report?

   • ATo assign blame for the incident
   • BTo satisfy regulatory compliance requirements
   • CTo inform incident response and future prevention efforts
   • DTo provide evidence for legal proceedings
   Reveal Solution Discussion Select an answer first