Explain the Categories and Subcategories of the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A manufacturing company is recovering from a malware attack that disrupted its inventory management system. The recovery team has restored the system and is verifying that inventory data is accurate. The company's sales team wants to inform customers that orders can be placed again. What should the recovery team do to support the sales team?

   • AProvide the sales team with a technical report of the malware's behavior
   • BProvide the sales team with a list of all customers affected by the malware
   • CAsk the sales team to wait until the next business day to contact customers
   • DConfirm that the inventory data is accurate and the system is fully functional
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which subcategory of Communications (RC.CO) in NIST CSF 2.0 involves coordinating recovery activities with internal and external parties?

   • ARC.CO-01: Recovery activities are coordinated with internal and external parties
   • BRC.CO-04: Recovery status is reported to stakeholders
   • CRC.CO-02: Recovery plans are updated with lessons learned
   • DRC.CO-03: Recovery plan is executed during or after an incident
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A bank's recovery team is conducting a post-incident review after a successful recovery from a phishing attack that compromised several employee accounts. The review found that the recovery plan did not include a step for notifying customers whose data may have been accessed. The team has updated the plan to include this step. What should the team do NEXT to ensure the plan is effective?

   • AArchive the old plan and create a new one from scratch
   • BWait for the next incident to see if the plan works
   • CImmediately notify all customers of the potential data access
   • DConduct a tabletop exercise to test the updated plan
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which subcategory of the Recovery Planning category (RC.RP) in NIST CSF 2.0 involves ensuring recovery plans are executed during or after an incident?

   • ARC.RP-01: Recovery plan is executed during or after an incident
   • BRC.RP-04: Recovery plan is communicated to stakeholders
   • CRC.RP-02: Recovery plan is updated with lessons learned
   • DRC.RP-03: Recovery activities are coordinated with internal and external parties
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A software development company experienced a security incident where a developer's laptop was compromised, and source code was exfiltrated. The recovery team restored the laptop from a backup and reset the developer's credentials. During the post-incident review, the team identified that the backup was 3 days old, causing the developer to lose 3 days of work. What should the team do to prevent this from happening again?

   • ARequire the developer to work overtime to recreate the lost work
   • BIncrease the backup frequency for developer laptops
   • CAsk the developer to use a cloud-based IDE to avoid local data loss
   • DDisable the developer's laptop until a new one is purchased
   Reveal Solution Discussion Select an answer first