Gain Knowledge on Analyzing Incidents with a Focus on Controls. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An incident response team has analyzed a phishing attack that resulted in the compromise of several user accounts. The team has contained the incident and is now preparing to communicate the results. Which stakeholder group should receive the most detailed technical analysis?

   • AExecutive leadership, to understand the business impact.
   • BPublic relations, to prepare a public statement.
   • CThe security operations team, to improve detection and response capabilities.
   • DThe IT help desk, to assist with user password resets.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is it important to document incident analysis findings clearly and accurately?

   • ATo replace the need for communication with stakeholders
   • BTo support decision-making and provide a record for reporting and legal purposes
   • CTo increase the complexity of the incident response process
   • DTo ensure that all employees have access to sensitive incident details
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After analyzing a phishing incident that led to credential compromise, the incident response team has confirmed that no data was exfiltrated. The team needs to communicate the results to the executive leadership. What is the most effective way to present the findings?

   • ASummarize the incident, the confirmed impact, the actions taken, and the recommended next steps in business terms.
   • BProvide a detailed technical report with all raw logs and analysis steps.
   • COnly inform the legal department and avoid sharing details with other executives to prevent panic.
   • DWait until the full forensic analysis is complete before communicating anything to avoid incomplete information.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is reviewing logs and notices that a user account has been locked out multiple times in a short period, followed by a successful login from a different geographic location. Which indicator of compromise is most directly suggested by this pattern?

   • AA brute-force attack followed by a successful account takeover.
   • BA distributed denial-of-service attack targeting the authentication server.
   • CA malware infection on the user's workstation that is spreading to other systems.
   • DA misconfigured password policy that is causing legitimate users to be locked out.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An organization is investigating a potential insider threat. The analyst has access to authentication logs, file access logs, and email logs. The analyst needs to determine if a user exfiltrated sensitive data. Which approach is most effective?

   • AReview only the email logs for any messages with attachments sent to external addresses.
   • BInterview the user to ask if they exfiltrated data.
   • CCorrelate authentication logs, file access logs, and email logs to identify a pattern of access and transmission of sensitive data.
   • DSearch for any user who accessed sensitive files outside of business hours.
   Reveal Solution Discussion Select an answer first