Gain Knowledge on Analyzing Incidents with a Focus on Controls. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key characteristic of effective incident analysis documentation?

   • AIt includes personal opinions about the incident
   • BIt is shared with all external parties immediately
   • CIt is written only after the incident is fully resolved
   • DIt is objective and based on verifiable evidence
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a systematic method used to collect and interpret incident data?

   • AIsolating the affected system and immediately restoring from backup
   • BDeleting logs that appear irrelevant to the incident
   • CEstablishing a timeline of events from logs and system artifacts
   • DRelying on memory of the incident from staff interviews
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a security control commonly applied during incident analysis to preserve evidence?

   • ACreating a forensic image of the affected system's storage
   • BRebooting the affected system to clear any temporary issues
   • CDisabling logging to reduce noise
   • DDeleting suspicious files to prevent further spread
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In the NIST Cybersecurity Framework 2.0, which function includes the category for incident analysis?

   • ARESPOND
   • BRECOVER
   • CDETECT
   • DPROTECT
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst is assessing the impact of a malware infection on a file server. The malware has encrypted files and left a ransom note. The analyst needs to determine the impact on the organization. Which factor is most important to consider?

   • AThe type of malware used in the attack.
   • BThe criticality of the affected files to business operations.
   • CThe number of files that were encrypted.
   • DThe ransom amount demanded by the attackers.
   Reveal Solution Discussion Select an answer first