Learn About the Processes Involved in Managing Incidents. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a ransomware incident, the incident response team needs to communicate with multiple stakeholders: employees, customers, law enforcement, and the media. What is the most important consideration when planning these communications?

   • ADelay all external communications until the incident is fully resolved
   • BTailor the message content and timing to each audience while ensuring consistency and accuracy
   • CSend the same detailed technical report to all stakeholders to ensure transparency
   • DCommunicate only through the legal department to minimize liability
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is updating its incident response plan. They want to ensure that during an incident, the right people are notified quickly and that the flow of information is efficient. What should they include in the plan?

   • AA communication tree that lists primary and backup contacts for each role
   • BA requirement that all communication go through a single point of contact
   • CA policy that only the CEO can authorize any incident response action
   • DA list of all employees' personal phone numbers
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of triage in the incident detection and analysis process?

   • ATo assign blame for the incident to specific individuals
   • BTo prioritize alerts based on their severity and potential impact
   • CTo permanently delete all suspicious files
   • DTo communicate the incident to external media outlets
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst notices repeated failed login attempts from a single IP address against a critical server. The attempts have been ongoing for several hours but have not yet succeeded. According to the NIST incident response process, what is the most appropriate immediate action?

   • AIgnore the activity because no login has succeeded, so there is no impact
   • BTreat it as a potential incident, begin triage, and gather additional context before deciding on containment
   • CNotify the server's owner and ask them to change the password immediately
   • DImmediately block the IP address at the firewall to prevent any possibility of a breach
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company's incident response team is documenting a security incident. They have collected logs, emails, and witness statements. The legal department has requested that the documentation be prepared in a way that is admissible in court. What is the most important factor to ensure the documentation is legally admissible?

   • AHave the documentation reviewed by the public relations department
   • BMaintain a clear chain of custody for all evidence
   • CEnsure the documentation is written in plain language
   • DInclude only the final conclusions, not the raw data
   Reveal Solution Discussion Select an answer first