Understand the Basic Concepts and Categories of the RESPOND Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company's security team is investigating a data exfiltration incident. The team has identified that a large volume of data was transferred to an external IP address over the past week. The team is under pressure to restore normal operations quickly. The team has two options: (1) immediately block the external IP and reset all user credentials, or (2) first conduct a thorough analysis of the exfiltration method and data accessed. Which approach best balances the need for quick containment with the need for a complete understanding of the incident?

   • AConduct a thorough analysis of the exfiltration method and data accessed, and do not block the external IP or reset credentials to avoid disrupting operations.
   • BImmediately block the external IP and reset all credentials, then conduct a thorough analysis of the exfiltration method and data accessed.
   • CBlock the external IP and reset all credentials, and do not conduct a thorough analysis to save time.
   • DConduct a thorough analysis of the exfiltration method and data accessed first, then block the external IP and reset all credentials.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security operations center (SOC) analyst is investigating an alert about a user downloading a suspicious file. The analyst determines that the file is a known banking trojan and that the user's machine has been compromised. The analyst needs to understand how the trojan entered the environment and what data it may have accessed. Which RESPOND category is the analyst primarily engaged in?

   • AIncident Analysis
   • BIncident Management
   • CIncident Response Reporting
   • DIncident Mitigation
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's security team has identified a phishing email that has been delivered to several employees. The team has confirmed that one employee clicked the link and entered credentials. The team is now working to reset the affected user's password, block the malicious domain at the firewall, and remove the phishing email from all mailboxes. Which RESPOND category do these actions primarily represent?

   • AIncident Management
   • BIncident Recovery Plan
   • CIncident Mitigation
   • DIncident Analysis
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following activities is most closely associated with incident analysis?

   • ARestoring services from backups
   • BDeploying additional security controls
   • CPreserving evidence and collecting logs
   • DNotifying customers about a data breach
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In the context of the RESPOND function, what is the primary purpose of incident triage?

   • ATo permanently delete all malicious files from affected systems
   • BTo prioritize incidents based on their severity and potential impact
   • CTo restore systems to their normal operational state
   • DTo identify the root cause of the incident
   Reveal Solution Discussion Select an answer first