Understand the Strategies and Techniques to Minimize the Impact of an Incident. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization discovers that a malware infection has spread to multiple servers in a DMZ. The servers host public-facing applications that are critical to the business. Which containment action should be taken to limit the spread while minimizing disruption to external customers?

   • ATake all affected servers offline immediately to stop the spread.
   • BDisconnect the DMZ from the internal network but leave the servers running.
   • CBlock all inbound traffic to the DMZ to prevent external access.
   • DMove the affected servers to a separate VLAN and restrict traffic to only necessary ports and protocols.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During an incident response, which strategy is primarily focused on preventing the spread of damage while the incident is still active?

   • AEradication
   • BRecovery
   • CContainment
   • DIdentification
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company's incident response team is responding to a suspected data exfiltration. The team has identified a compromised server that is communicating with an external IP. The server is also a domain controller, and taking it offline would disrupt authentication for the entire organization. Which action best minimizes impact while containing the incident?

   • AImmediately shut down the server to stop the exfiltration.
   • BIsolate the server at the network level by blocking its outbound traffic, while maintaining internal authentication services.
   • CIgnore the external communication and focus on monitoring for further exfiltration.
   • DDisconnect the server from the network and promote a backup domain controller.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which output is a typical result of post-incident analysis?

   • ADeletion of backup data
   • BImmediate containment of the incident
   • CUpdated incident response procedures
   • DIsolation of the affected network
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security incident has been confirmed, and the incident response team is activating its response plan. Which communication step is most critical to ensure effective coordination and minimize impact?

   • AContact the media to provide a public statement about the incident.
   • BEstablish a secure communication channel and define roles and responsibilities for each team member.
   • CSend a company-wide email to inform all employees about the incident.
   • DDocument all actions taken so far and store them in a shared folder.
   Reveal Solution Discussion Select an answer first