Understand the Basic Concepts and Categories of the RESPOND Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company's SOC has detected a potential insider threat. An employee is suspected of downloading sensitive data to a personal USB drive. The SOC team has confirmed the download but is unsure if the employee has shared the data. The team is under pressure from management to take action. Which sequence of actions best aligns with the RESPOND function's categories to address the threat while preserving evidence?

   • AAnalyze the downloaded data to determine what was taken, then disable the employee's network access and confiscate the USB drive.
   • BImmediately confront the employee and ask them to return the USB drive, then analyze the downloaded data to determine what was taken.
   • CImmediately disable the employee's network access and confiscate the USB drive, then analyze the downloaded data to determine what was taken.
   • DReport the incident to management and let them decide what to do, without taking any direct action.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of incident response reporting in the RESPOND function?

   • ATo document the incident for internal training purposes only
   • BTo provide a detailed technical analysis of the malware used
   • CTo inform stakeholders and authorities about the incident and response actions
   • DTo justify the budget for cybersecurity investments
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large enterprise has just confirmed a ransomware attack that is actively encrypting files on network shares. The incident response team is under pressure from executives to contain the attack quickly. The team has identified the patient-zero workstation and has the authority to take immediate action. Which sequence of actions best aligns with the RESPOND function's categories to minimize impact while maintaining visibility?

   • AImmediately isolate the patient-zero workstation, then analyze the ransomware's behavior to identify other affected systems, then report to executives.
   • BIsolate the patient-zero workstation, then report to executives, then analyze the ransomware's behavior to identify other affected systems.
   • CReport to executives first to get approval for containment, then isolate the workstation, then analyze the ransomware's behavior.
   • DAnalyze the ransomware's behavior first to understand its full scope, then isolate the patient-zero workstation, then report to executives.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In the NIST Cybersecurity Framework 2.0, what is the primary purpose of the RESPOND function?

   • ATo identify and inventory all assets and data
   • BTo restore systems and data to normal operation
   • CTo take action regarding a detected cybersecurity incident
   • DTo continuously monitor and detect anomalies
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which activity is part of the Incident Management category of the RESPOND function?

   • ARestoring data from backups
   • BImplementing security patches to prevent future incidents
   • CCoordinating response activities among relevant stakeholders
   • DConducting forensic analysis of compromised systems
   Reveal Solution Discussion Select an answer first