Understand the Basic Concepts and Categories of the RESPOND Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary objective of incident mitigation in the RESPOND function?

   • ATo restore systems to their normal operational state
   • BTo communicate the incident to external stakeholders
   • CTo identify the root cause of the incident
   • DTo contain, eradicate, and reduce the impact of an incident
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A regional bank has just confirmed a ransomware attack that encrypted files on several file servers. The incident response team has contained the spread and is now preparing to communicate with external stakeholders. According to the RESPOND function, which action is most directly associated with the Incident Response Reporting category?

   • ADocumenting the indicators of compromise in the organization's threat intelligence platform
   • BNotifying the state banking regulator and law enforcement as required by law
   • CRestoring the encrypted file servers from the most recent clean backups
   • DDisconnecting the file servers from the network to stop the encryption process
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which activity is part of executing an incident recovery plan?

   • ARestoring data from verified backups
   • BIsolating the affected network segment
   • CNotifying regulatory authorities
   • DConducting forensic analysis of the compromised system
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During a suspected data breach, the incident response team discovers that a database administrator's account was used to export a large volume of customer records. The team needs to determine whether the account was compromised or if the administrator performed the export intentionally. Which activity is most directly associated with the Incident Analysis category?

   • ANotifying the organization's legal counsel about the potential breach
   • BRestoring the database from a backup taken before the export occurred
   • CDisabling the administrator's account to prevent further data exfiltration
   • DReviewing authentication logs and correlating them with the administrator's known work schedule
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary goal of incident analysis in the RESPOND function?

   • ATo immediately isolate all affected systems from the network
   • BTo determine the scope, impact, and root cause of the incident
   • CTo communicate the incident to external authorities
   • DTo develop a plan for restoring systems to normal operation
   Reveal Solution Discussion Select an answer first