Explain the Significance of Incident Recovery Communication and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of defining escalation paths in an incident recovery communication plan?

   • ATo provide a clear process for involving higher-level management or external parties when an issue exceeds current authority.
   • BTo replace the need for a designated incident response team.
   • CTo ensure that all communication is approved by the CEO before being sent.
   • DTo automatically send all incident details to external media outlets.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A healthcare provider is coordinating recovery with an external security firm. The firm needs access to a secure portal to upload and download sensitive patient data for analysis. The provider's security team is concerned about the risk of data leakage and unauthorized access. The firm's analysts are located in different countries, and some are contractors. Which security control is most effective in ensuring that only the firm's assigned analysts can access the portal?

   • AProvide the portal link to the firm's project manager and let them distribute it to their team.
   • BRequire the firm to use a shared generic account for all analysts to simplify access management.
   • CAllow access from any IP address to avoid blocking legitimate analysts in different countries.
   • DIssue each analyst a unique certificate and require multi-factor authentication (MFA) for portal access.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which security control ensures that only authorized personnel can access recovery communication systems?

   • AAuthentication and access controls
   • BEncryption
   • CNetwork segmentation
   • DLogging and monitoring
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why should legal stakeholders be included in incident recovery coordination?

   • ATo provide financial resources for recovery efforts.
   • BTo provide technical expertise for system restoration.
   • CTo manage public relations and media communications.
   • DTo ensure compliance with legal and regulatory obligations during recovery.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A government agency is recovering from a data exfiltration incident. The recovery team is using a shared document repository to store status reports and evidence. The team needs to ensure that only authorized personnel can view the documents and that any changes are tracked. Which security control is most directly needed to meet this requirement?

   • AA firewall to protect the repository from external network attacks.
   • BRole-based access control (RBAC) and audit logging on the repository.
   • CFull-disk encryption on the repository server.
   • DA strong password policy for all agency employees.
   Reveal Solution Discussion Select an answer first