Learn About the Processes Involved in Managing Incidents. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   After resolving a major security incident, the incident response team conducts a post-incident review. They identify that the response was delayed because the on-call analyst did not have the necessary credentials to access the SIEM. What should the team do to address this finding?

   • AUpdate the incident response plan and access control procedures to ensure on-call analysts have the required access
   • BDocument the delay in the incident report and move on
   • CBlame the on-call analyst for not requesting access earlier
   • DPurchase a new SIEM tool that is easier to access
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a data breach, the incident response team needs to coordinate with external parties, including law enforcement, a forensic investigator, and the organization's cyber insurance provider. What is the best way to manage these communications?

   • ADesignate a single liaison to coordinate all external communications
   • BCommunicate only through the company's public relations department
   • CLimit external communication to only the forensic investigator
   • DAllow each team member to communicate directly with external parties as needed
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which method is commonly used to detect potential security incidents?

   • AMonitoring network traffic for anomalous activity
   • BPerforming routine software updates
   • CConducting annual employee performance reviews
   • DReviewing marketing campaign performance
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   During a major incident, the incident response team discovers that the breach involves personal data of customers in multiple countries. The company's legal counsel advises that they must notify regulators within 72 hours in some jurisdictions. However, the forensic investigation is still ongoing, and the full scope of the breach is not yet known. What is the best course of action?

   • ANotify only the regulators in the company's home country
   • BAsk the forensic investigator to provide a preliminary report before notifying regulators
   • CWait until the investigation is complete to provide a full and accurate report
   • DNotify regulators within the required timeframe with the information available, and provide updates as the investigation progresses
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How can lessons learned from an incident be used to improve the incident response process?

   • ABy sharing the lessons learned only with the incident response team
   • BBy ignoring the lessons learned to avoid changing established procedures
   • CBy deleting the incident response plan to start fresh
   • DBy updating the incident response plan based on identified gaps
   Reveal Solution Discussion Select an answer first