Learn About the Processes Involved in Managing Incidents. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A healthcare organization experiences a data breach involving protected health information (PHI). The incident response team has contained the breach and is now preparing documentation. What is the most important reason to document the incident thoroughly and accurately?

   • ATo justify the incident response team's salaries to management
   • BTo provide a detailed technical manual for future attackers
   • CTo create a public relations statement for the media
   • DTo meet regulatory reporting requirements and support potential legal proceedings
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the purpose of a post-incident review?

   • ATo assign blame to the incident response team
   • BTo delete all records of the incident
   • CTo restore systems to their normal operating state
   • DTo identify what went wrong and what went well during the incident response
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A regional bank's incident response plan designates the CISO as the incident commander. During a suspected data breach, the CISO is unreachable. The deputy CISO assumes command and begins containment. Later, the CISO returns and demands to take over, but the deputy has already made key decisions. What should the incident response plan have specified to avoid this conflict?

   • AA policy that the most senior person present always leads the response
   • BA clear chain of command with defined escalation and transfer-of-authority procedures
   • CA communication plan that requires all updates to be sent to the CISO's personal email
   • DA requirement that all major decisions be approved by the legal department
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization experiences a security incident that does not trigger any legal or regulatory reporting requirements. The incident response team has resolved the issue. What should they do with the incident documentation?

   • ARetain the documentation for a defined period and use it for lessons-learned reviews
   • BDelete the documentation immediately to reduce storage costs
   • CShare the documentation publicly to demonstrate transparency
   • DOnly document incidents that have regulatory reporting requirements
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company discovers that malware has infected several workstations and is communicating with an external command-and-control server. The incident response team wants to stop the spread and prevent data exfiltration while preserving evidence. Which containment strategy should they use first?

   • AReimage the infected workstations from a known-good backup
   • BUpdate the antivirus signatures and run a full scan on all workstations
   • CPower off the infected workstations immediately
   • DDisconnect the infected workstations from the network
   Reveal Solution Discussion Select an answer first