Why is timely communication of recovery progress important?

To prevent unauthorized access to the network

To satisfy legal requirements for all incidents

To increase the speed of the recovery process

To keep stakeholders informed and manage expectations

A company has restored its systems after a ransomware attack. The security team is monitoring for signs of reinfection. Which monitoring activity is most likely to detect a reinfection early?

Monitor CPU usage on all servers for any spikes.

Monitor outbound network traffic for communication with known command-and-control (C2) servers.

Check disk space usage to ensure backups are not filling up.

Review user login logs for failed attempts.

A financial services firm is recovering from a data breach that affected customer records. The recovery team is working to restore systems, but the CEO wants daily status updates. Which action best addresses the CEO's need while supporting the recovery process?

Send the CEO a detailed technical log of all recovery actions daily.

Give the CEO direct access to the recovery team's chat channel for real-time updates.

Assign a liaison to provide the CEO with concise daily progress reports and escalate critical issues.

Wait until recovery is complete before reporting to the CEO to avoid confusion.

A manufacturing company's recovery plan is activated after a cyber incident. The plan lists the IT manager as the recovery lead, but the IT manager is on vacation and unreachable. What is the most appropriate action?

Activate the designated alternate recovery lead as defined in the plan.

Contact the IT manager's supervisor to decide who should lead.

Have the most senior IT staff member take over without formal designation.

Wait for the IT manager to return before starting recovery.

Dell NIST Cybersecurity Framework v2.0

Domain 7Objective 4

Elaborate the Tools and Techniques That Can Be Employed for Incident Recovery Plan Execution. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Part of the NIST Framework: RECOVER Function domain, which accounts for 7% of the NIST-CYBERSECURITY-FRAMEWORK-2 exam.

35questions here

7free pages

10concepts

7%of the exam

Questions 11–15

11foundation · easy
Why is timely communication of recovery progress important?
Select an answer first
12expert · hard
A company has restored its systems after a ransomware attack. The security team is monitoring for signs of reinfection. Which monitoring activity is most likely to detect a reinfection early?
Select an answer first
13application · medium
A financial services firm is recovering from a data breach that affected customer records. The recovery team is working to restore systems, but the CEO wants daily status updates. Which action best addresses the CEO's need while supporting the recovery process?
Select an answer first
14foundation · easy
Which external party might need to be coordinated with during recovery if the incident involves a data breach?
Select an answer first
15application · medium
A manufacturing company's recovery plan is activated after a cyber incident. The plan lists the IT manager as the recovery lead, but the IT manager is on vacation and unreachable. What is the most appropriate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NIST-CYBERSECURITY-FRAMEWORK-2

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Dell Technologies. “NIST-CYBERSECURITY-FRAMEWORK-2” is a trademark of its owner, used for identification only.