Explain the Categories and Subcategories of the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the NIST Cybersecurity Framework 2.0, what is the primary purpose of the RECOVER function?

   • ATo identify and document cybersecurity risks before an incident occurs
   • BTo detect and analyze cybersecurity incidents in real time
   • CTo restore assets and operations that were affected by a cybersecurity incident
   • DTo communicate incident details to external stakeholders
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A retail company is recovering from a point-of-sale (POS) malware infection. The recovery team has isolated the infected systems and is restoring the POS servers from clean backups. The company's legal counsel has asked for a status update to prepare a regulatory notification. What should the recovery team provide to legal counsel?

   • AThe names of all employees who used the infected POS systems
   • BA detailed technical report of the malware's code and behavior
   • CA list of all customers who made purchases during the infection period
   • DA summary of the recovery progress and expected completion time
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A telecommunications company is reviewing its recovery procedures after a major outage caused by a faulty software update. The recovery team successfully restored services using a rollback procedure. The post-incident review identified that the rollback procedure was not documented in the recovery plan and was performed ad-hoc. What should the company do to improve its recovery process?

   • ADocument the rollback procedure in the recovery plan and test it
   • BRely on the ad-hoc procedure since it worked successfully
   • CReplace the recovery plan with a new one that includes the rollback procedure
   • DNotify all employees of the rollback procedure via email
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A regional hospital experienced a ransomware attack that encrypted patient records and clinical applications. The IT director has activated the incident response plan and the organization's backup solution has restored the core EHR system. However, the restored EHR is now running an older version of the software that is incompatible with the current laboratory information system. The hospital needs to resume normal operations as quickly as possible. What should the recovery team do FIRST?

   • ANotify the laboratory staff that the EHR will be unavailable for the next 48 hours
   • BRe-image all clinical workstations to ensure they have a clean operating system
   • CRestore the laboratory information system from backups to match the EHR version
   • DConsult the recovery plan's system restoration sequence and dependency documentation
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of the Communications category within the RECOVER function in NIST CSF 2.0?

   • ATo detect and analyze cybersecurity incidents
   • BTo coordinate internal and external communications during recovery activities
   • CTo incorporate lessons learned into recovery processes
   • DTo develop and implement recovery plans for systems and assets
   Reveal Solution Discussion Select an answer first