Elaborate the Tools and Techniques That Can Be Employed for Incident Recovery Plan Execution. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After rebuilding a web server from a clean image, the security team wants to ensure it is safe to place back into production. Which validation step is most important?

   • ACheck that the server's hostname and IP address are correct.
   • BConfirm the server can serve web pages to a test client.
   • CRun a vulnerability scan and verify the server's security configuration against the baseline.
   • DVerify that the server is reachable from the internet.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   After restoring a database from a backup, the security team notices that the database is responding slowly and there are unexpected queries being executed. What is the most likely explanation and the best course of action?

   • AThe database is overloaded; add more resources to improve performance.
   • BThe database is simply re-indexing; wait for it to complete.
   • CThe backup may have been compromised; isolate the database and investigate the queries.
   • DThe backup was corrupted; restore from a different backup.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's email server crashed due to a hardware failure. The last full backup is from the previous night, and the server also uses continuous data protection (CDP) that replicates changes to a secondary location. What is the fastest way to recover the email service with minimal data loss?

   • ARestore the full backup and then apply the CDP logs to recover the most recent changes.
   • BRebuild the server from scratch and reconfigure email services.
   • CRestore only the full backup and accept the loss of changes since last night.
   • DUse the CDP replica as the primary server without restoring the full backup.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which activity is part of post-recovery monitoring?

   • AUpdating the incident response plan
   • BReviewing system logs for unusual activity
   • CDeleting temporary files to free up space
   • DInforming users that the system is back online
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the purpose of post-recovery monitoring?

   • ATo detect any signs of residual issues or reinfection
   • BTo document the recovery process for auditors
   • CTo ensure the system is running faster than before
   • DTo verify that all users have changed their passwords
   Reveal Solution Discussion Select an answer first