Understand the Strategies and Techniques to Minimize the Impact of an Incident. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After a major incident, the incident response team is conducting a lessons-learned meeting. Which outcome is most valuable for improving future incident response?

   • AA list of employees who were involved in the incident response.
   • BA detailed timeline of the incident for the company's annual report.
   • CA summary of the incident for the board of directors.
   • DA list of actionable improvements to the incident response plan and security controls.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which containment technique involves disconnecting an infected system from the network to prevent lateral movement?

   • AEradication
   • BSegmentation
   • CPatching
   • DIsolation
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After containing a ransomware outbreak, the incident response team has identified the initial entry point and the malware variant. The team is now planning to restore affected file servers from backups. Which step should be completed BEFORE restoring the servers to ensure the threat is fully removed?

   • ANotify all employees that the systems will be temporarily unavailable.
   • BEradicate the malware from all affected systems and verify no persistence mechanisms remain.
   • CRestore the servers from the most recent backup immediately to minimize downtime.
   • DDisconnect the backup storage from the network to protect it from the malware.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After a malware infection, the incident response team has contained the affected systems and is ready to recover. Which recovery action is most important to ensure the systems are clean before returning to production?

   • AChange all user passwords and enable multi-factor authentication.
   • BRebuild the systems from a known-good image and apply all security patches.
   • CRestore the systems from the latest backup without scanning for malware.
   • DReconnect the systems to the network and monitor for unusual activity.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which sequence correctly represents the typical order of incident impact minimization strategies?

   • AContainment → Recovery → Eradication
   • BRecovery → Containment → Eradication
   • CEradication → Recovery → Containment
   • DContainment → Eradication → Recovery
   Reveal Solution Discussion Select an answer first