Learn About the Processes Involved in Managing Incidents. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the purpose of defining communication procedures in an incident response plan?

   • ATo provide a channel for employees to report security incidents anonymously
   • BTo ensure that only the incident response team is aware of the incident
   • CTo ensure timely and accurate information sharing with relevant stakeholders
   • DTo document the incident for regulatory compliance
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a key component of an incident response plan?

   • AA list of all employees' personal contact information
   • BA detailed description of the organization's marketing strategy
   • CA backup of all critical data stored offsite
   • DA set of predefined roles and responsibilities for incident response team members
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of the incident response process within the NIST Cybersecurity Framework?

   • ATo manage the impact of a security incident on the organization
   • BTo prevent all security incidents from occurring
   • CTo assign blame for the incident to responsible parties
   • DTo detect and analyze potential security incidents
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A multinational company is updating its incident response plan. They have offices in multiple countries with different data protection laws. During an incident, they must notify regulators in several jurisdictions, each with different timelines. What is the best approach to handle this complexity?

   • ANotify all regulators only after the incident is fully contained
   • BIncorporate a regulatory notification matrix into the plan that maps each jurisdiction's requirements and timelines
   • CUse the most restrictive jurisdiction's timeline for all notifications
   • DDesignate a single legal team to handle all regulatory notifications without a predefined plan
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   After a phishing incident, the incident response team conducts a lessons-learned review. They find that the email gateway's spam filter was not configured to block a new type of phishing email. What is the most effective improvement to prevent recurrence?

   • AUpdate the email gateway rules and add the new phishing indicators to threat intelligence feeds
   • BConduct a one-time security awareness training session for all employees
   • CDisable email attachments for all users
   • DReplace the email gateway with a different vendor's product
   Reveal Solution Discussion Select an answer first