Understand the Basic Concepts and Categories of the RESPOND Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of incident response reporting?

   • ANotifying regulatory authorities about a data breach
   • BRestoring data from a backup
   • CAnalyzing network traffic to identify the attack vector
   • DIsolating an infected system from the network
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company's security team has identified a worm that is spreading across the network. The team has a choice: (1) immediately disconnect all affected systems from the network to stop the spread, or (2) first analyze the worm's propagation method to understand how it spreads, then disconnect the affected systems. The team is under pressure to minimize downtime. Which approach best balances the need for rapid containment with the need for a complete understanding of the threat?

   • AImmediately disconnect all affected systems, then analyze the worm's propagation method to understand how it spreads.
   • BFirst analyze the worm's propagation method, then disconnect all affected systems.
   • CAnalyze the worm's propagation method and do not disconnect affected systems to avoid disrupting operations.
   • DDisconnect all affected systems and do not analyze the worm's propagation method to save time.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A software company experiences a denial-of-service attack that makes its customer portal unavailable for several hours. After the attack is mitigated, the company's CEO asks the security team for a summary of what happened, what was done, and the current status. Which RESPOND category does this request directly support?

   • AIncident Mitigation
   • BIncident Analysis
   • CIncident Response Reporting
   • DIncident Management
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following best describes the role of the RESPOND function in the NIST Cybersecurity Framework 2.0?

   • AIt supports the ability to contain and mitigate the effects of cybersecurity incidents
   • BIt establishes policies and procedures for business continuity
   • CIt provides training and awareness to employees
   • DIt defines the organization's risk appetite and tolerance
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which action is an example of incident mitigation?

   • ASending a notification to affected customers
   • BConducting a post-incident review meeting
   • CCreating a backup of critical data
   • DDisconnecting an infected server from the network
   Reveal Solution Discussion Select an answer first