Explain the Significance of Incident Recovery Communication and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A utility company is recovering from a distributed denial-of-service (DDoS) attack that disrupted customer-facing services. The recovery team needs to coordinate with the internet service provider (ISP), the state public utilities commission, and internal customer support leadership. The team is preparing a status update. Which stakeholder communication is most critical to prioritize first to ensure legal and regulatory compliance?

   • ANotify the state public utilities commission of the service disruption and recovery status.
   • BInform the ISP of the attack so they can assist with traffic filtering and mitigation.
   • CBrief internal customer support leadership so they can handle customer inquiries.
   • DPrepare a public statement for the media to inform customers of the outage.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which component is essential in an incident recovery communication plan?

   • AA detailed technical analysis of the root cause of the incident.
   • BA backup of all critical data and systems.
   • CDefined roles, responsibilities, and escalation paths for communication.
   • DA list of all employees' personal contact information for direct outreach.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A regional hospital is recovering from a ransomware attack that encrypted patient records. The IT director needs to provide regular status updates to the hospital board, the state health department, and the public relations team. The CIO insists that all recovery status communications be sent through a secure channel that only authorized leadership can access. Which approach best satisfies the requirement for secure, coordinated recovery communication?

   • APost updates to a public-facing status page so all stakeholders can access the same information transparently.
   • BSend encrypted email updates to a pre-approved distribution list containing board members, the state health department contact, and PR staff.
   • CHold daily conference calls with all stakeholders and read the status update aloud to avoid written records.
   • DUse a secure collaboration platform with role-based access control, granting board members, the state health department liaison, and PR leadership access to a dedicated recovery status channel.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A software development company is recovering from a credential theft incident. The recovery team needs to communicate with affected customers, but the legal team has advised that the notification must not reveal specific technical vulnerabilities that could be exploited. The team also needs to coordinate with the marketing department to craft the message. What is the most important security control to apply to the communication process in this scenario?

   • ARestrict access to the customer contact list to only the recovery team lead.
   • BUse a dedicated email server for all customer communications.
   • CImplement an approval workflow that requires legal and marketing to review the message before it is sent.
   • DEncrypt the customer notification emails to protect them from interception.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following best describes the role of communication in the RECOVER Function of the NIST Cybersecurity Framework?

   • AIt replaces the need for formal documentation of recovery actions.
   • BIt ensures that recovery activities are coordinated and that stakeholders are kept informed of progress and decisions.
   • CIt focuses solely on notifying law enforcement about the incident.
   • DIt is used only after recovery is complete to share lessons learned.
   Reveal Solution Discussion Select an answer first