Gain Knowledge on Analyzing Incidents with a Focus on Controls. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An incident response team has confirmed a data breach involving customer credit card information. The team needs to communicate the findings to the legal department, public relations, and executive leadership. What is the most important consideration for this communication?

   • ATailor the communication to each audience, focusing on the impact and actions relevant to their role.
   • BOnly communicate with the executive leadership and let them decide what to share with others.
   • CDelay communication until all facts are fully confirmed to avoid misinformation.
   • DProvide each stakeholder group with the same detailed technical report to ensure consistency.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   During an incident, an analyst discovers that an attacker has established persistence on a compromised host by creating a new local user account. The analyst needs to contain the incident while preserving evidence. Which control is most appropriate?

   • AChange the password of the new user account to prevent the attacker from logging in.
   • BTake a forensic image of the host, then disable the new user account.
   • CDisable the new user account and document the action.
   • DDelete the new user account immediately to remove the attacker's access.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard · select all that apply

   An analyst is reviewing network traffic and notices a series of DNS queries to a domain that is known to be associated with malware. The analyst also sees that a workstation is sending data to an IP address in a foreign country. Which indicators of compromise are present? (Select all that apply.)

   • AA new scheduled task on the workstation.
   • BDNS queries to a known malicious domain.
   • CUnusual outbound network traffic to a foreign IP address.
   • DA sudden increase in CPU usage on the workstation.
   Check answers Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of effective communication of analysis results?

   • APosting incident details on a public website
   • BProviding a concise summary of findings and recommended actions to management
   • CSending the full raw log data to all employees
   • DWaiting until the next quarterly meeting to report the incident
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An incident response team is analyzing a compromised server. They need to preserve evidence for potential legal action while also continuing to monitor the attacker's activities. Which control is most appropriate to achieve both objectives?

   • AUse a network tap to capture traffic and take a forensic image of the server's memory and disk, while maintaining network connectivity for monitoring.
   • BDisconnect the server and immediately restore it from a backup to minimize downtime.
   • CEnable verbose logging on the server and allow the attacker to continue, while capturing all network traffic.
   • DTake a full disk image and memory dump, then isolate the server from the network.
   Reveal Solution Discussion Select an answer first