Understand the Strategies and Techniques to Minimize the Impact of an Incident. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A server was compromised by a web shell placed through a vulnerable web application. The incident response team has contained the server and confirmed the web shell is the only backdoor. Which action should be taken to eradicate the threat and prevent re-infection?

   • AChange the administrator password and enable multi-factor authentication.
   • BRebuild the server from a known-good image and restore data from backups.
   • CDelete the web shell and restart the web server service.
   • DPatch the web application vulnerability, remove the web shell, and verify no other persistence mechanisms exist.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During a ransomware incident, the incident response team is considering whether to pay the ransom to restore encrypted files. The company has backups, but they are not fully tested. Which approach best minimizes the impact of the incident?

   • APay the ransom immediately to get the decryption key and restore files quickly.
   • BShut down all systems and wait for law enforcement to provide a decryption tool.
   • CIgnore the incident and hope the ransomware does not spread further.
   • DAttempt to restore from backups first, while continuing to contain the spread and communicate with stakeholders.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which activity is part of the recovery process after an incident?

   • ADisconnecting affected systems from the network
   • BDeleting malicious files
   • CRestoring systems from clean backups
   • DIdentifying the attack vector
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After a phishing campaign successfully compromised several user accounts, the incident response team contained the breach and restored systems. The team is now conducting a post-incident review. Which activity is most important for reducing the impact of future similar incidents?

   • ADocument the incident timeline and store it in the incident response plan.
   • BDelete all phishing emails from user mailboxes to prevent further clicks.
   • CIncrease the frequency of password changes for all users.
   • DIdentify the root cause and implement additional email filtering and user training.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which containment technique is most appropriate for limiting the impact of a worm that spreads across network segments?

   • ASegmentation
   • BIsolation of a single host
   • CEradication
   • DRecovery
   Reveal Solution Discussion Select an answer first