Explain the Categories and Subcategories of the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A retail company's e-commerce website was taken offline by a ransomware attack. The recovery team has restored the website from a backup and is now testing the payment processing functionality. The company's marketing team wants to announce the website is back online. What should the recovery team do before the announcement?

   • AProvide the marketing team with a technical analysis of the ransomware
   • BAsk the marketing team to delay the announcement until the next business day
   • CConfirm that the payment processing functionality is working correctly
   • DProvide the marketing team with a list of all affected customers
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services firm completed a recovery from a data breach that involved a compromised backup administrator account. During the post-incident review, the team discovered that the backup software did not support multi-factor authentication (MFA) at the time of the incident. The vendor has since released a version that supports MFA. According to the NIST CSF 2.0 RECOVER function, what should the organization do to address this finding?

   • AImmediately restore all systems from the compromised backup account's last known good backup
   • BUpdate the recovery plan to include the new backup software version and its MFA configuration
   • CDocument the finding in the incident report and close the case
   • DDisable the backup administrator account until the vendor releases another update
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A healthcare organization is recovering from a distributed denial-of-service (DDoS) attack that targeted its patient portal. The portal is now back online, and the IT team is verifying that patient data is intact. The organization's public relations team wants to issue a statement to patients. What should the recovery team do to support the PR team?

   • AProvide the PR team with a list of all patients affected by the DDoS attack
   • BAsk the PR team to wait until the next scheduled maintenance window
   • CProvide the PR team with a technical analysis of the DDoS attack vectors
   • DConfirm that the portal is fully functional and patient data is secure
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary focus of the Recovery Planning category in the NIST Cybersecurity Framework 2.0?

   • AMonitoring network traffic for signs of malicious activity
   • BIdentifying and documenting all organizational assets and their vulnerabilities
   • CDeveloping and implementing plans to restore systems and assets after an incident
   • DCommunicating incident details to external stakeholders
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A cloud-based SaaS provider experienced a service outage due to a misconfigured database migration. The recovery team restored the database from a snapshot taken 6 hours before the incident. However, the restored database is missing transactions that occurred during the 6-hour window. The company's recovery point objective (RPO) is 15 minutes. The CEO wants to know when the service can be fully restored. What is the MOST appropriate course of action?

   • AUse transaction logs to replay the missing transactions into the restored database
   • BRestore the database from an earlier snapshot to ensure data consistency
   • CInform the CEO that the service is restored and the missing data is acceptable
   • DDeclare the incident unrecoverable and rebuild the database from scratch
   Reveal Solution Discussion Select an answer first