Explain the Significance of Incident Recovery Communication and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A financial services firm is activating its incident recovery plan after a data breach. The plan designates the CISO as the primary spokesperson, the legal counsel to review all external statements, and the IT operations lead to provide technical updates to the recovery team. During the first coordination meeting, the CISO is unavailable due to a personal emergency. According to the communication plan, what should the team do?

   • AActivate the designated alternate spokesperson and notify the recovery team of the change.
   • BWait for the CISO to become available before issuing any external communications.
   • CHave the legal counsel assume the spokesperson role temporarily since they are already reviewing statements.
   • DHave the IT operations lead provide the external update since they have the most technical knowledge.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is it important to document lessons learned in a post-incident report?

   • ATo improve future incident response and recovery processes.
   • BTo share with competitors for benchmarking.
   • CTo justify the cost of the incident to stakeholders.
   • DTo create a permanent record for legal defense.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A manufacturing company is recovering from a ransomware attack that halted production. The recovery team is communicating with the plant floor managers, the corporate IT team, and the company's cyber insurance provider. The insurance provider requires a preliminary claim notification within 48 hours, but the plant managers need immediate operational updates to resume production. The corporate IT team is concerned about sharing too much technical detail with the insurance provider. What is the best course of action?

   • AWait until the recovery is complete before notifying the insurance provider to provide a full and accurate claim.
   • BHave the plant managers communicate directly with the insurance provider to speed up the claim process.
   • CShare all technical details with the insurance provider to ensure the claim is accurate, and delay operational updates to plant managers.
   • DProvide the insurance provider with the preliminary notification immediately, and share operational updates with plant managers through a secure channel.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A logistics company has completed the recovery phase of a system outage. The incident response manager is writing the post-incident report. The report must be useful for improving the incident response process. Which approach is most effective for structuring the report?

   • AOrganize the report chronologically, listing every action taken by each team member.
   • BWrite a brief summary of the incident and attach all raw logs and emails as appendices.
   • CFocus the report on the technical root cause analysis and the fix that was applied.
   • DStructure the report around the incident response phases, highlighting what worked, what did not, and recommendations for each phase.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of a post-incident report?

   • ATo provide a detailed technical manual for all IT systems.
   • BTo satisfy customer requests for refunds.
   • CTo assign blame for the incident to specific individuals.
   • DTo document recovery actions, lessons learned, and improvements for future incidents.
   Reveal Solution Discussion Select an answer first