Understand the Strategies and Techniques to Minimize the Impact of an Incident. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is experiencing a data breach involving customer personal information. The incident response team needs to coordinate with legal, PR, and IT teams. Which communication strategy is most effective for minimizing impact during the response?

   • ACommunicate only with the IT team to avoid panic and keep the incident confidential.
   • BSend a single email to all employees with the details of the breach.
   • CEstablish a dedicated communication channel and hold regular status meetings with all stakeholders.
   • DWait until the investigation is complete before informing any external parties.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary goal of the eradication process in incident response?

   • AIdentify the root cause of the incident
   • BRemove the threat from affected systems
   • CLimit the spread of the incident
   • DRestore systems to normal operation
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst detects a workstation on the corporate network communicating with a known command-and-control server. The workstation is used by the finance team and contains sensitive data. The analyst needs to stop the spread of the threat while preserving evidence for forensic analysis. Which action should the analyst take first?

   • AReboot the workstation to clear the malware from memory.
   • BRun a full antivirus scan on the workstation.
   • CDisconnect the workstation from the network by disabling its switch port.
   • DNotify the finance team and ask them to stop using the workstation.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During an active incident, the incident response team needs to share sensitive indicators of compromise (IOCs) with external partners. Which communication method is most appropriate?

   • APost the IOCs on a public forum to quickly inform the community.
   • BSend the IOCs via standard unencrypted email to ensure quick delivery.
   • CUse an encrypted and authenticated channel, such as a secure portal or PGP-encrypted email.
   • DShare the IOCs over a phone call to avoid digital traces.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the main purpose of a post-incident review (also known as a lessons-learned meeting)?

   • ADelete all evidence of the incident
   • BIdentify improvements to future incident handling
   • CRestore systems to normal operation
   • DAssign blame to individuals involved
   Reveal Solution Discussion Select an answer first