Gain Knowledge on Analyzing Incidents with a Focus on Controls. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of correlating data from multiple sources during incident analysis?

   • ATo assign a severity rating to each individual log entry
   • BTo identify relationships and patterns that reveal the full scope of the incident
   • CTo ensure that all data is encrypted in transit
   • DTo reduce the amount of data that needs to be stored
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An organization is responding to a ransomware incident. The incident response team needs to preserve evidence while also containing the spread. The affected systems are virtual machines on a hypervisor. Which approach best balances evidence preservation with containment?

   • ACopy the virtual disk files to a forensic server and then restore the VMs from backups.
   • BDisconnect the VMs from the network and wait for the ransomware to complete its encryption before collecting evidence.
   • CImmediately power off all affected VMs to stop the ransomware from encrypting more data.
   • DTake a snapshot of each affected VM, then isolate the VMs from the network while keeping them running for memory analysis.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During an incident, an analyst discovers that a server containing proprietary source code was accessed by an unauthorized user. The analyst must assess the impact on the organization. Which factor is most important to consider when determining the impact?

   • AThe operating system of the server that was accessed.
   • BThe potential loss of intellectual property and its effect on competitive advantage.
   • CThe time of day the unauthorized access occurred.
   • DThe number of times the server was accessed by the unauthorized user.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After analyzing a malware infection, an analyst has identified the entry vector, the files affected, and the command-and-control server. The analyst must document the findings. What is the most important element to include in the documentation?

   • AThe names of the incident response team members involved.
   • BA timeline of events from initial compromise to detection, with supporting evidence.
   • CThe cost of the incident to the organization.
   • DThe exact commands used to remediate the infection.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What does assessing the impact of an incident primarily involve?

   • ADetermining the effect on confidentiality, integrity, and availability of assets
   • BCalculating the exact financial cost of the incident
   • CDetermining which security controls failed
   • DIdentifying the IP address of the attacker
   Reveal Solution Discussion Select an answer first