Elaborate the Tools and Techniques That Can Be Employed for Incident Recovery Plan Execution. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company's file server was compromised by a rootkit that may have persisted in the firmware. The recovery team is deciding whether to restore from backup or rebuild from scratch. What is the most important factor in this decision?

   • ARebuilding from scratch is always faster than restoring from backup.
   • BThe backup may also be infected if the rootkit was present when the backup was taken.
   • CRestoring from backup is the only way to preserve user data.
   • DThe recovery team should always choose the least expensive option.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company has just completed the recovery of its systems after a major incident. The recovery team is preparing for the post-incident review. What documentation is most critical to have for this review?

   • AThe cost of the recovery effort.
   • BA list of all employees involved in the recovery.
   • CThe final status of all recovered systems.
   • DA chronological log of all recovery actions, decisions, and communications.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is recovering from a cyber incident. The recovery team has been working for 12 hours and is fatigued. The incident commander wants to ensure that communication with stakeholders remains effective. What is the best approach?

   • AHave the incident commander handle all communications personally.
   • BAutomate all status updates using a dashboard.
   • CImplement a shift rotation for the recovery team and designate a communication lead for each shift.
   • DReduce the frequency of updates to conserve team energy.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of integrating lessons learned into the incident recovery plan?

   • ATo satisfy regulatory requirements for all incidents
   • BTo assign blame for the incident
   • CTo document the incident for insurance claims
   • DTo improve future recovery efforts
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a key component that should be included in an incident recovery plan?

   • AThe contact information for all employees in the organization
   • BDetailed procedures for restoring systems and data
   • CA marketing plan to communicate with customers after the incident
   • DA list of approved vendors for purchasing new hardware
   Reveal Solution Discussion Select an answer first