Explain the Significance of Incident Recovery Communication and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which external party should be coordinated with during recovery if the incident involves a data breach affecting customers?

   • ARegulators
   • BCompetitors
   • CHardware manufacturers
   • DSocial media influencers
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A university is recovering from a phishing attack that compromised several faculty accounts. The recovery team is coordinating with the university's legal counsel, the IT security team, and the affected faculty members. The team needs to provide a status update to the university president. What is the most important consideration when preparing this update for the president?

   • AInclude a detailed technical analysis of the phishing email headers and malware payload.
   • BList the names of all affected faculty members and the specific data that was compromised.
   • CProvide a high-level summary of the incident impact, recovery progress, and any legal or regulatory implications.
   • DFocus only on the technical steps taken to contain the attack.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which security control is most important to protect the confidentiality of communication channels during incident recovery?

   • AIntrusion detection system
   • BData backup
   • CEncryption
   • DFirewall rules
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After containing a malware infection, a retail company's recovery team has restored systems and is now preparing the post-incident report. The report must document the recovery actions taken, the effectiveness of the communication plan, and lessons learned. Which element is most important to include to ensure the report improves future incident response?

   • AA list of all software versions and patches applied during recovery.
   • BAn analysis of what went well, what went poorly, and specific recommendations for process changes.
   • CA detailed timeline of when each system was restored and by whom.
   • DA copy of all internal emails exchanged during the incident.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A hospital's recovery team is updating its incident communication plan after a recent ransomware event. The plan needs to define how to communicate with patients whose data may have been exposed. The team is deciding on the escalation path for notifying patients. Which element is essential for the escalation path in this plan?

   • AA list of external PR agencies that can be hired to manage the communication.
   • BA template for the patient notification letter.
   • CA clear chain of command specifying who approves the patient notification and in what order.
   • DA list of all patients' email addresses and phone numbers.
   Reveal Solution Discussion Select an answer first