What type of reporting may be required after a security incident?

Reporting to the organization's competitors

Reporting to social media platforms for advertising purposes

Reporting to regulatory bodies as required by law

Reporting to the organization's insurance provider for premium discounts

A security operations center (SOC) receives an alert about a possible malware infection on a user's workstation. The alert is based on a single suspicious file hash. The SOC analyst has limited information. What should the analyst do next?

Immediately quarantine the workstation and reimage it

Gather additional context, such as the file's origin, other systems affected, and threat intelligence

Escalate the alert to law enforcement without further analysis

Ignore the alert because it is based on a single indicator

Which activity is part of the eradication phase of incident response?

Removing malware from affected systems

Conducting a lessons-learned review

Isolating affected systems from the network

Why is documenting incident details important?

To delete all evidence of the incident

To provide a record for legal and regulatory purposes

To increase the organization's social media presence

To assign blame to specific employees

Which external party might need to be notified during incident response?

The organization's marketing agency

Dell NIST Cybersecurity Framework v2.0

Domain 6Objective 2

Learn About the Processes Involved in Managing Incidents. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Part of the NIST Framework: RESPOND Function domain, which accounts for 8% of the NIST-CYBERSECURITY-FRAMEWORK-2 exam.

30questions here

6free pages

7concepts

8%of the exam

Questions 6–10

6foundation · easy
What type of reporting may be required after a security incident?
Select an answer first
7application · medium
A security operations center (SOC) receives an alert about a possible malware infection on a user's workstation. The alert is based on a single suspicious file hash. The SOC analyst has limited information. What should the analyst do next?
Select an answer first
8foundation · easy
Which activity is part of the eradication phase of incident response?
Select an answer first
9foundation · easy
Why is documenting incident details important?
Select an answer first
10foundation · easy
Which external party might need to be notified during incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NIST-CYBERSECURITY-FRAMEWORK-2

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Dell Technologies. “NIST-CYBERSECURITY-FRAMEWORK-2” is a trademark of its owner, used for identification only.