Explain the Categories and Subcategories of the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A multinational corporation is recovering from a ransomware attack that affected its email system. The recovery team has restored the email servers and is now verifying that all mailboxes are accessible. The corporate communications team wants to send an internal email to all employees announcing the restoration. However, the legal team has advised that the email should not be sent until the investigation is complete. What is the BEST course of action?

   • ASend the email as planned, as the system is restored and employees need to know
   • BDelay the email until the legal team completes its investigation
   • CSend a partial email stating that the system is being restored
   • DAsk the legal team to provide a list of approved messages
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which NIST Cybersecurity Framework 2.0 function is responsible for restoring assets and operations that were disrupted by a cybersecurity incident?

   • ARESPOND
   • BPROTECT
   • CDETECT
   • DRECOVER
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the NIST Cybersecurity Framework 2.0, what is the main purpose of the Process Improvement category within the RECOVER function?

   • ATo incorporate lessons learned and improve recovery plans and processes
   • BTo identify and prioritize critical assets for recovery
   • CTo detect and analyze the root cause of the incident
   • DTo communicate recovery status to internal and external stakeholders
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A logistics company's recovery plan specifies that the primary ERP system must be restored within 4 hours (RTO) and with no more than 1 hour of data loss (RPO). During a recent disaster, the ERP was restored in 3.5 hours, but the data was 2 hours old. The recovery team is now reviewing the plan. What is the MOST appropriate action?

   • AInvestigate why the data loss exceeded the RPO and adjust the backup frequency
   • BUpdate the RPO to 2 hours to reflect what was actually achieved
   • CDocument the incident as a success because the RTO was met
   • DIncrease the RTO to 5 hours to allow more time for data recovery
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A utility company is recovering from a cyberattack that disrupted its customer billing system. The recovery team has restored the system and is verifying data integrity. The company's CEO wants to issue a public statement to customers. However, the legal team has advised that the statement should not mention the word 'ransomware' because the investigation is ongoing. What should the recovery team do?

   • ACoordinate with the legal team to draft a statement that complies with their advice
   • BAdvise the CEO to delay the statement until the investigation is complete
   • CProvide the CEO with a list of all customers affected by the attack
   • DProvide the CEO with a technical summary of the attack for the statement
   Reveal Solution Discussion Select an answer first