Learn About the Processes Involved in Managing Incidents. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is it important to communicate with internal stakeholders during incident response?

   • ATo assign blame for the incident to specific departments
   • BTo gather marketing feedback on the incident response
   • CTo hide the incident from external parties
   • DTo ensure that all employees are aware of the incident and can take appropriate action
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary goal of incident containment?

   • ATo limit the scope and impact of the incident
   • BTo identify the root cause of the incident
   • CTo delete all data associated with the incident
   • DTo restore systems to their normal operating state
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company's incident response team is responding to a ransomware attack. The ransomware has encrypted files on several file servers. The team has isolated the affected servers. They have backups, but the backups are from two days ago, and some recent files will be lost. The company's leadership wants to minimize data loss and downtime. What is the best recovery strategy?

   • ARebuild the servers from scratch and recreate the data manually
   • BRestore from the backups and accept the loss of recent changes, then implement additional backup frequency
   • CAttempt to decrypt the files using free decryption tools
   • DPay the ransom to get the decryption key and avoid data loss
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A small business has no formal incident response plan. An employee reports a suspicious email attachment that they opened, and the computer is now behaving erratically. According to the NIST incident response process, what is the first step the business should take?

   • ANotify law enforcement right away
   • BImmediately disconnect the computer from the network
   • CDevelop a full incident response plan before doing anything else
   • DDetect and analyze the situation to confirm whether an incident has occurred
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In the NIST Cybersecurity Framework 2.0, which function does the incident response process primarily support?

   • APROTECT
   • BIDENTIFY
   • CRECOVER
   • DRESPOND
   Reveal Solution Discussion Select an answer first