Elaborate the Tools and Techniques That Can Be Employed for Incident Recovery Plan Execution. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which recovery strategy is most appropriate for a critical database that must be restored with minimal data loss?

   • AFailover to a standby server that is updated nightly
   • BUse point-in-time recovery with transaction log backups
   • CRestore from the most recent full backup
   • DRebuild the database from scratch using application logs
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of integrating lessons learned into the recovery plan?

   • AUpdating the contact list for the recovery team
   • BChanging the backup software used by the organization
   • CDeleting the recovery plan because it was not followed
   • DAdding a new step to the recovery procedures based on what was discovered
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why is it important to document all recovery actions taken during an incident?

   • ATo provide a record for post-incident review and improvement
   • BTo speed up the recovery process
   • CTo satisfy customer requests for information
   • DTo ensure the recovery process is kept confidential
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A malware infection compromised several servers in a DMZ. The security team decides to rebuild these servers rather than restore from backups. What is the most important step to ensure the rebuilt servers are secure before returning them to production?

   • ARestore user data from the most recent backup to minimize disruption.
   • BApply the latest security patches and verify the configuration matches the approved baseline.
   • CReconnect the servers to the network immediately to resume services quickly.
   • DNotify the incident response team that the rebuild is complete.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After restoring a file server from a ransomware attack, the IT team notices unusual outbound network traffic from the server. What is the most appropriate immediate action?

   • AIsolate the server from the network and investigate the traffic for signs of reinfection.
   • BRestore the server again from the same backup that was used previously.
   • CDisable the server's firewall to allow full traffic analysis.
   • DIncrease the server's logging level and continue monitoring for 24 hours.
   Reveal Solution Discussion Select an answer first