Gain Knowledge on Analyzing Incidents with a Focus on Controls. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An analyst is investigating a potential data exfiltration incident. The organization uses a SIEM, but the logs from the firewall and the proxy are not correlating properly due to time zone differences. The analyst has identified a suspicious file transfer to an external IP. What is the most appropriate action to ensure accurate analysis?

   • AIgnore the time zone differences and rely on the sequence of events as recorded in each log.
   • BConfigure the SIEM to normalize timestamps to a standard time zone and re-ingest the logs.
   • CUse the external IP address alone to determine the incident's scope without correlating with other logs.
   • DManually adjust the timestamps in the logs to a common time zone and then correlate the events.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of applying containment controls during incident analysis?

   • ATo identify the root cause of the incident
   • BTo permanently delete all malicious files
   • CTo restore systems to their normal operating state
   • DTo limit the spread of the incident while analysis continues
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During an incident, an analyst needs to preserve evidence from a compromised server. The server is running a critical business application that cannot be taken offline for an extended period. Which control is most appropriate to preserve evidence while minimizing downtime?

   • ATake a live memory dump and a logical copy of the relevant files.
   • BPower off the server and take a full disk image.
   • CDisconnect the server from the network and leave it running.
   • DCopy the entire disk using a forensic tool while the server is running.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst notices a sudden spike in outbound traffic from a single workstation to an external IP address that is not on any known threat list. The workstation also shows a new scheduled task that runs a PowerShell script. The analyst must determine if this is a real incident before escalating. Which combination of actions is most appropriate for the initial analysis?

   • ABlock the external IP at the firewall and close the case, assuming the traffic was a false positive.
   • BDisconnect the workstation from the network and immediately reimage it to prevent further damage.
   • CRun a full antivirus scan on the workstation and, if no malware is found, ignore the alert.
   • DCorrelate the outbound traffic with the scheduled task execution times, check the script content, and compare the external IP against additional threat intelligence sources.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Within the NIST Cybersecurity Framework 2.0 RESPOND function, what is the primary purpose of incident analysis?

   • ATo assign blame to the individual or group responsible for the incident
   • BTo determine the root cause and scope of an incident to inform response and recovery actions
   • CTo identify all vulnerabilities in the organization's systems before an incident occurs
   • DTo restore affected systems to normal operation as quickly as possible
   Reveal Solution Discussion Select an answer first