Describe the Significance of Adverse Event Analysis and Associated Security Controls in DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst receives an alert from a monitoring tool. The analyst must decide whether to escalate the alert to the incident response team. What is the primary purpose of adverse event analysis in this decision?

   • ATo assign a unique identifier to the alert
   • BTo document the alert for compliance purposes only
   • CTo automatically remediate the issue without human intervention
   • DTo determine if the alert is a true positive and warrants a response
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which security control is specifically designed to collect and store records of system and network activity for later analysis?

   • AEndpoint detection and response (EDR) agent
   • BIntrusion prevention system (IPS)
   • CSecurity information and event management (SIEM) correlation engine
   • DLogging and log management
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does adverse event analysis directly support the incident response process?

   • AIt replaces the need for a formal incident response plan
   • BIt provides the detailed understanding of an event needed to determine the appropriate response actions
   • CIt automatically contains and eradicates threats without human involvement
   • DIt focuses solely on legal evidence collection for prosecution
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary function of an alerting mechanism in the context of adverse event detection?

   • ATo replace the need for manual log review
   • BTo block malicious traffic at the network perimeter
   • CTo automatically patch vulnerabilities in affected systems
   • DTo notify security personnel when a monitored condition indicates a potential issue
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which statement best describes the role of adverse event analysis in the NIST Cybersecurity Framework 2.0 DETECT function?

   • AIt is a compliance requirement that focuses on documenting events for regulatory audits
   • BIt is a reactive process that occurs only after an incident has been fully contained
   • CIt is a continuous process that turns raw data into actionable insights about potential incidents
   • DIt is a preventive measure that stops attacks before they occur
   Reveal Solution Discussion Select an answer first