Explain the Categories and Subcategories of the DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the NIST Cybersecurity Framework 2.0, which activity is a subcategory of Adverse Event Analysis?

   • AMonitoring network traffic for unusual patterns
   • BDeclaring an incident based on predefined criteria
   • CEstimating the financial impact of a detected incident
   • DCorrelating event data from multiple sources to identify a potential incident
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which activity is a subcategory of Detection Processes in the NIST CSF 2.0?

   • AAnalyzing detected events to understand their nature
   • BMonitoring personnel activity for potential threats
   • CTesting detection processes to ensure they are effective
   • DDetermining the appropriate response to an incident
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   According to the NIST Cybersecurity Framework 2.0, which of the following activities is a subcategory of Continuous Monitoring?

   • AMonitoring the organization's network to find potential cybersecurity threats
   • BTesting detection processes to ensure they are effective
   • CCorrelating event data from multiple sources to identify a potential incident
   • DDeclaring an incident based on predefined criteria
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A security analyst is correlating data from firewall logs, IDS alerts, and authentication records to determine if a coordinated attack is underway. Which DETECT category does this activity map to?

   • AContinuous Monitoring
   • BDetection Technology
   • CAdverse Event Analysis
   • DIncident Impact
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A manufacturing company's SOC analyst sees an alert indicating that a workstation has been beaconing to a known command-and-control domain. The analyst verifies the alert, determines that the activity is malicious, and then formally notifies the incident response team that a security incident has occurred. Which DETECT subcategory does the analyst's action of formally notifying the IR team represent?

   • AIncident declaration
   • BAnalyzing detected events
   • CTesting detection processes
   • DEstimating incident impact
   Reveal Solution Discussion Select an answer first