Understand the Basic Concepts and Categories of the RESPOND Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst receives an alert from the EDR platform indicating that a workstation has been beaconing to a known command-and-control domain. The analyst confirms the alert is a true positive and immediately isolates the workstation from the network. Which RESPOND category does this action primarily support?

   • AIncident Mitigation
   • BIncident Analysis
   • CIncident Response Reporting
   • DIncident Management
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing company's production scheduling system was taken offline by a malware infection. The incident has been contained and eradicated. The IT manager is now focused on bringing the system back online in a controlled manner and verifying that it operates correctly. Which RESPOND category is the IT manager primarily executing?

   • AIncident Mitigation
   • BIncident Analysis
   • CIncident Recovery Plan
   • DIncident Management
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A hospital's IT team detects unusual outbound traffic from a medical device. The team leader assigns a junior analyst to investigate the traffic while simultaneously notifying the hospital's privacy officer and the device vendor. The team leader is also tracking the status of these activities in a ticketing system. Which RESPOND category best describes the team leader's overall role in this scenario?

   • AIncident Management
   • BIncident Mitigation
   • CIncident Analysis
   • DIncident Response Reporting
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of an incident recovery plan in the RESPOND function?

   • ATo document the incident for legal purposes
   • BTo prevent any future incidents from occurring
   • CTo restore systems and operations to normal after an incident
   • DTo identify the attackers responsible for the incident
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a category of the RESPOND function in the NIST Cybersecurity Framework 2.0?

   • AAwareness and Training
   • BIncident Response Reporting
   • CAsset Management
   • DAnomaly Detection
   Reveal Solution Discussion Select an answer first