Gain Knowledge on Analyzing Incidents with a Focus on Controls. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 7)

Questions 31–32

1. 31foundation · easy

   Which of the following is a common indicator of compromise (IOC) that might signal a security incident?

   • AAn unexpected outbound connection from a server to a known malicious IP address
   • BA scheduled backup completing successfully
   • CA user changing their password after a routine reminder
   • DAn increase in network bandwidth during a scheduled maintenance window
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst notices that a server is communicating with an IP address that is listed on a threat intelligence feed as a known command-and-control server. The analyst also sees that the server is running a process that is not in the baseline. What should the analyst do first?

   • AIgnore the alert because the IP is only on a threat intelligence feed and may be a false positive.
   • BImmediately block the IP address at the firewall and kill the suspicious process.
   • CIsolate the server from the network and preserve the process memory for analysis.
   • DReboot the server to clear the suspicious process from memory.
   Reveal Solution Discussion Select an answer first