Elaborate the Tools and Techniques That Can Be Employed for Incident Recovery Plan Execution. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a recommended practice when reconfiguring a system after a security incident?

   • AVerify the system against the approved baseline after reconfiguration
   • BReuse the previous configuration to save time
   • CApply all available patches and updates
   • DUse the original installation media to rebuild the system
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During a post-incident review, the recovery team identifies that the backup verification step was skipped, causing a delay in restoring a critical database. What is the best way to integrate this lesson into the recovery plan?

   • AReplace the backup software with a new tool that automates verification.
   • BAdd a mandatory backup verification step to the recovery plan and update the checklist.
   • CDocument the incident in the lessons learned report and close the review.
   • DRetrain the backup team on the importance of verification.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a recommended practice for communicating recovery status?

   • AShare detailed technical information with all employees
   • BProvide updates only when the recovery is complete
   • CProvide regular status updates to relevant parties
   • DUse a single communication channel for all audiences
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's recovery plan requires that all recovery actions be documented. During a fast-paced recovery, the team is tempted to skip documentation to save time. What is the best way to ensure documentation is completed without slowing down recovery?

   • ASkip documentation during recovery and reconstruct it later.
   • BAssign a dedicated scribe to document actions in real time.
   • CHave each team member document their own actions at the end of the day.
   • DUse automated logging tools to capture system changes.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail company is recovering from a POS system outage. The recovery team has restored the systems, but customers are being told conflicting information about when services will resume. What should the recovery team do to address this?

   • ADesignate a single spokesperson to provide consistent updates to customers and the public.
   • BLet each store manager communicate the status to their customers.
   • CWait until all services are fully restored before making any public statements.
   • DPost updates on social media without internal coordination.
   Reveal Solution Discussion Select an answer first