Explain the Categories and Subcategories of the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A university's IT department is reviewing its recovery procedures after a phishing attack compromised several faculty accounts. The review found that the recovery plan did not include a step for resetting compromised credentials. The team has since updated the plan to include this step. What additional action should the team take to complete the process improvement cycle?

   • ADelete the old recovery plan to avoid confusion
   • BTest the updated recovery plan in a simulated exercise
   • CWait for the next incident to see if the updated plan works
   • DNotify all faculty members that their accounts are secure
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which subcategory of Process Improvement (RC.IM) in NIST CSF 2.0 requires that recovery plans be updated with lessons learned?

   • ARC.IM-03: Recovery activities are coordinated
   • BRC.IM-04: Recovery plan is executed
   • CRC.IM-01: Recovery plans incorporate lessons learned
   • DRC.IM-02: Recovery strategies are updated
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A government agency is recovering from a data breach that compromised its citizen services portal. The recovery team has restored the portal from a backup and is now testing the application. The agency's leadership wants to know when the portal will be available to citizens. What should the recovery team provide to leadership?

   • AThe names of the recovery team members involved in the restoration
   • BAn estimated time of restoration based on the testing progress
   • CA detailed list of all security patches applied to the portal
   • DA copy of the incident response plan for review
   Reveal Solution Discussion Select an answer first